Top Risks

• Free-webmail developer (wl.exten.02@gmail.com) with numbered alias — low accountability.
• WhatsApp brand impersonation: unverified dev builds tool for WhatsApp Web without confirmed ownership.
• Content script on web.whatsapp.com can read chat DOM including message content.
• Install URL hijack opens web.whatsapp.com on install — onboarding or tracking hook.
• DOM innerHTML sink in vendor JS raises XSS risk within WhatsApp Web context.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user, not Meta/WhatsApp.
• free_webmail_numbered_alias store Developer email wl.exten.02@gmail.com matches numbered-alias pattern; +3.0 webstore signal.
• install_url_hijack manifest install_url_hijack=true; target=https://web.whatsapp.com on extension install.
• dom_sink_innerhtml_userctrl crx innerHTML assignment in assets/js/vendor.DzFEYc3-.js; DOM-XSS sink in WhatsApp Web context.
• content_script_whatsapp manifest content_scripts_matches=['https://web.whatsapp.com/*']; can access full chat DOM.
• privacy_policy_third_party_sharing api Policy fetched, scoped, data_collection+retention+third_party_sharing all true; adequate but shares data.
• external_js_hosts crx js_external_hosts: hc-stt.hiperchat.com.br, reactjs.org, web.whatsapp.com — 2 distinct registrable domains.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP hardening declared.

Permissions Breakdown

• unlimitedStorage low Allows extended local storage; low direct harm, needed for CRM caching.
• storage low Standard key-value storage; no exfil risk on its own.
• tabs medium Can read tab URLs/titles; paired with WhatsApp content script scope.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM content.

Pillar Scores

Bookkeeping