Top Risks

• Google privacy policy used as extension policy: does not scope to this extension's data collection (v3.5-D rule, +10 privacy).
• Cookies permission + WhatsApp host access: can exfiltrate WhatsApp session cookies to coderlicences.com backend.
• No CSP + function_constructor + 3x innerHTML DOM-XSS sinks across content/background scripts.
• Free-webmail dev (gmail), no developer name, no verified publisher: unaccountable operator.
• Small install count (68) with high-tier permissions: tail-attack-surface anomaly flagged.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5-D).
• function_constructor crx new Function() constructor in app.js — dynamic code execution risk (+2.5 code quality).
• dom_sink_innerhtml_no_csp crx 3 innerHTML sinks across app.js/background.js/contentScript.js with csp_present=false → elevated to +2.0 each (FIX B).
• no_csp_mv3 manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• free_webmail_no_devname store Dev email albecinogueira@gmail.com, developer_name empty, not verified publisher → reputation floor 7.5.
• cookies_whatsapp_scope manifest cookies permission scoped to web.whatsapp.com — can read WhatsApp session tokens.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 68 installs with cookies+tabs+declarativeNetRequest.
• js_external_hosts crx External hosts notiflix.github.io and reactjs.org referenced in JS; 2 countries (BR, US).

Permissions Breakdown

• storage low Local data persistence, low risk.
• unlimitedStorage low Extended storage quota, low risk.
• tabs medium Can read tab URLs and metadata across browser.
• cookies high Can read/write cookies; scoped to WhatsApp and coderlicences domains.
• notifications low Display desktop notifications, minor nuisance risk.
• declarativeNetRequest medium Can modify/block network requests via rules.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session.
• https://app.coderlicences.com/* medium Access to third-party licensing backend; potential data exfil path.

Pillar Scores

Bookkeeping