Top Risks

• Google account privacy policy used as proxy — does not scope data handling for this WhatsApp CRM extension.
• cookies permission on web.whatsapp.com enables full session token access; could exfiltrate auth cookies.
• function_constructor (new Function) + unprotected innerHTML sinks across 3 JS files with no CSP.
• Free-webmail dev (gmail), no developer name, no business website — unverifiable identity.
• Small install base (65) with high-tier permissions: classic tail-attack surface.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() constructor found in app.js — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in app.js, background.js, contentScript.js with no CSP protection.
• cookies_on_whatsapp manifest cookies permission scoped to web.whatsapp.com — full WhatsApp session token accessible.
• free_webmail_no_devname store Developer email lbwhatscrm@gmail.com; developer_name empty; no business domain.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — remote CDN references without CSP guard.
• small_install_high_perm api 65 installs + high-tier permissions (cookies, tabs, declarativeNetRequest on WhatsApp).
• third_party_license_server manifest host_permissions include https://app.coderlicences.com/* — unverifiable data recipient.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• unlimitedStorage low Extends storage quota; low standalone risk.
• tabs medium Can read tab URLs and metadata across sessions.
• cookies high Can read/write cookies; scoped to host_permissions but includes WhatsApp session.
• notifications low Displays desktop notifications; low abuse potential.
• declarativeNetRequest medium Can intercept/block network requests per ruleset.
• https://web.whatsapp.com/* high Full content-script access to WhatsApp web; can read messages/contacts.
• https://app.coderlicences.com/* medium Unverifiable third-party licensing server; data sent to unknown entity.

Pillar Scores

Bookkeeping