I'd guess its some form of transient-key cryptography. When you scan the QR code, the smartphone app tells the WA servers to 'allow' the web browser to send/receive messages as itself.

Thinking a bit more it could be that the messages are routed through the phone itself, and so it requires the app to be running and connected.