Top Risks

• Free-webmail Gmail dev with no verified identity raises impersonation and accountability risk.
• WhatsApp brand impersonation: developer does not own WhatsApp yet injects into whatsapp.com.
• Content script on WhatsApp Web can read chat messages; no high permissions but sensitive context.
• Install-URL hijack opens web.whatsapp.com on install — minor but a redirect signal.
• DOM innerHTML sink in vendor bundle without CSP creates XSS risk if WhatsApp data flows through it.

Evidence

• free_webmail_dev store Developer email wl.exten.01@gmail.com is a numbered-alias free webmail account; no business identity.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain gmail.com, confirmed_owner=false.
• whatsapp_content_script manifest Content script injected into https://web.whatsapp.com/* enabling access to chat DOM/data.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — minor redirect, confirms WhatsApp targeting.
• dom_xss_sink crx innerHTML used with variable in vendor bundle; no CSP present on MV3 extension to mitigate.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• privacy_policy_adequate api Policy at privacy.opt-api.com is fetched, scoped, covers data collection, retention, and 3rd-party sharing.
• low_installs store Only 14 installs; tail-attack-surface anomaly flag not triggered but reach is minimal currently.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; no cross-origin risk.
• storage low Standard local storage; minimal risk.
• tabs medium Can read tab URLs/titles; some info-disclosure potential.
• alarms low Scheduling only; no data access.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read chat content in that context.

Pillar Scores

Bookkeeping