Top Risks

• Privacy policy is generic Google account policy — does not scope to this extension; classified as non-compliant.
• Free-webmail developer (ggranclube@gmail.com) with no developer name or verified business identity.
• cookies permission + content script on web.whatsapp.com enables reading WhatsApp session cookies.
• new Function() constructor and multiple innerHTML DOM-XSS sinks in app.js, background.js, contentScript.js; no CSP mitigates this.
• Small install base (14) with high-tier permissions is a tail-attack-surface anomaly.

Evidence

• free_webmail_developer store Developer email ggranclube@gmail.com; no developer name; no verified publisher status.
• generic_privacy_policy store Privacy policy URL is Google Account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• cookies_high_risk manifest cookies permission combined with host access to web.whatsapp.com — can read session cookies.
• function_constructor_code crx new Function() constructor found in app.js; evaluated code path without CSP guard.
• dom_xss_sinks crx innerHTML assignments found in app.js, background.js, contentScript.js with no CSP to block injection.
• no_csp manifest content_security_policy is null; MV3 default applies but JS sinks and Function() remain unmitigated.
• small_install_high_perm store Only 14 installs with cookies + tabs + declarativeNetRequest + whatsapp host — install_perm_anomaly flagged.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — CDN references add supply-chain surface.

Permissions Breakdown

• storage low Standard local data persistence, minimal risk.
• unlimitedStorage low Extends storage quota; no direct data-exfil risk.
• tabs medium Can read tab URLs and metadata across all open tabs.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com hosts.
• notifications low Push notifications; limited direct risk.
• declarativeNetRequest medium Can block/redirect network requests without seeing content.
• https://web.whatsapp.com/* high Content script + cookies access on WhatsApp — sensitive messaging data.
• https://app.coderlicences.com/* medium Access to unknown third-party licensing backend; accountability unclear.

Pillar Scores

Bookkeeping