Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp impersonation: brand_mention.is_impersonation=true, developer is unverified Gmail account.
• Host permission to unknown third-party domain crm-proadmin3.tiendak43.com enables data exfiltration.
• new Function() constructor in content script running inside WhatsApp Web context.
• No CSP declared (MV3 strict default applies but DOM-XSS sink + function_constructor still present).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is Gmail account with no verified ownership.
• generic_privacy_policy store Privacy URL points to Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• unknown_exfil_endpoint manifest host_permission crm-proadmin3.tiendak43.com — unrecognized third-party backend for a WhatsApp CRM.
• function_constructor crx new Function() found in content script running on web.whatsapp.com — dynamic code execution risk.
• dom_xss_sink crx innerHTML assignment from variable in content script; no CSP mitigating injection in this context.
• free_webmail_developer store Developer email amhgforres@gmail.com with no business domain; Reputation floor applied.
• js_external_hosts_broad crx 12 external JS hosts including generativelanguage.googleapis.com and socket.io indicating broad network reach.
• low_install_count store Only 39 installs; low social proof for a tool requesting WhatsApp content access.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but supports large local data caching.
• storage low Standard local storage for extension state.
• alarms low Scheduling background tasks; low risk alone.
• tabs medium Can read tab URLs and metadata across open tabs.
• https://web.whatsapp.com/* high Full content-script access to WhatsApp Web — reads messages and DOM.
• https://crm-proadmin3.tiendak43.com/* high Exfiltration endpoint on unknown third-party domain; all XHR/fetch allowed.

Pillar Scores

Bookkeeping