Top Risks

• Gmail dev email 'contasdeanunciosdeparceiros@gmail.com' with no developer name or verified identity; name translates to 'partner ad accounts'.
• Privacy policy is Google's generic account policy — does not scope to this extension; classified as data_collection+third_party_sharing with no extension scope.
• cookies permission paired with WhatsApp Web host access enables reading full session cookies from a sensitive messaging platform.
• new Function() constructor and multiple innerHTML DOM-XSS sinks present in app.js, background.js, and contentScript.js with no CSP.
• small_install_high_perm anomaly (15 installs, high-tier permissions); third-party licensing endpoint app.coderlicences.com is an unverified exfil surface.

Evidence

• free_webmail_dev_no_name store Developer email is gmail.com, developer_name is empty; no verified business identity.
• generic_google_privacy_policy store Privacy URL points to myaccount.google.com/privacypolicy — generic Google policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_on_sensitive_host manifest cookies permission + host_permission for web.whatsapp.com allows reading WhatsApp session cookies.
• function_constructor_code crx new Function() in app.js — dynamic code execution risk without CSP.
• dom_xss_sinks crx innerHTML sinks in app.js, background.js, contentScript.js; csp_present=false amplifies risk.
• third_party_license_endpoint manifest host_permission for app.coderlicences.com — unknown operator, potential data collection endpoint.
• install_perm_anomaly api 15 installs with high-tier permissions (cookies, tabs, declarativeNetRequest, whatsapp host).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on DOM sinks.

Permissions Breakdown

• storage low Standard local data persistence.
• unlimitedStorage low Extends storage quota; low standalone risk.
• tabs medium Can read tab URLs and metadata across sessions.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com but still sensitive.
• notifications low Can display desktop notifications; low abuse potential alone.
• declarativeNetRequest medium Can block/redirect network requests; less risky than webRequest but notable.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session data.
• https://app.coderlicences.com/* medium Third-party licensing server; unknown operator, potential data exfil path.

Pillar Scores

Bookkeeping