Top Risks

• Gmail dev address, no developer name, no verified publisher — minimal accountability for WhatsApp CRM tool.
• cookies permission on web.whatsapp.com grants access to WhatsApp session cookies; high session-hijack risk.
• Privacy policy is Google's generic policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• 22 months since update; extension accessing sensitive platform with no maintenance signals.
• innerHTML DOM-XSS sink in contentScript.js on WhatsApp origin with no CSP; amplified risk.

Evidence

• free_webmail_dev_no_name store Developer email booset.club@gmail.com is free webmail; developer_name is empty string.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• cookies_on_whatsapp manifest cookies permission + host access to web.whatsapp.com enables WhatsApp session cookie theft.
• dom_xss_sink_no_csp crx dom_sink_innerhtml_userctrl in contentScript.js; csp_present==false amplifies to +2.0 code quality.
• stale_extension store 22 months since last update; 6–24mo band (+6.0 maintenance).
• small_install_high_perm api Only 9 installs with cookies+tabs+host access to WhatsApp — tail attack surface anomaly.
• js_external_hosts crx Contacts api.coderlicences.com, app.coderlicences.com, debuginfod.archlinux.org, reactjs.org externally.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D clause).

Permissions Breakdown

• storage low Standard local data storage; low risk.
• unlimitedStorage low Allows large local storage; minor concern for disk usage.
• tabs medium Can read tab URLs and metadata; moderate privacy exposure.
• cookies high Can read/write cookies on host_permission origins (WhatsApp).
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session data.
• https://app.coderlicences.com/* medium Access to unknown third-party licensing service.

Pillar Scores

Bookkeeping