Top Risks

• Cookie access on WhatsApp Web enables session-token theft from a sensitive messaging platform.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• new Function() constructor + multiple innerHTML sinks without CSP create DOM-XSS attack surface.
• No CSP declared (MV3 default only); external JS hosts notiflix.github.io and reactjs.org loaded.
• Small install base (69) with high-privilege permissions — tail attack surface risk.

Evidence

• cookies + WhatsApp host permission manifest cookies permission paired with https://web.whatsapp.com/* enables full session cookie read/write on WhatsApp.
• generic Google privacy policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor in app.js crx new Function() used in app.js — dynamic code execution risk, especially without CSP.
• dom_sink_innerhtml_userctrl x3 crx innerHTML sinks in app.js, background.js, contentScript.js with no CSP — DOM-XSS risk.
• no CSP declared manifest content_security_policy is null; csp_present=false. MV3 default applies but eval-equivalent new Function() is present.
• external JS hosts crx js_external_hosts: notiflix.github.io, reactjs.org — remote CDN references in extension context.
• small_install_high_perm anomaly api 69 installs with high-tier permissions (cookies, tabs, declarativeNetRequest, WhatsApp host) — tail attack surface.
• unverified publisher, no brand impersonation store verified_publisher=false, is_featured_by_google=false; developer domain sevenxpro.com.br resolves.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Expands storage quota; no direct data exfil capability.
• tabs medium Can read tab URLs and titles across browsing session.
• cookies high Can read/write cookies; scoped to host_permissions (WhatsApp + backend).
• notifications low User-facing notifications only; minimal data exposure.
• declarativeNetRequest medium Can modify/block network requests; no broad host override declared.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session cookies.
• https://app.coderlicences.com/* medium Access to licensing backend; potential for auth-token exfil to 3rd-party.

Pillar Scores

Bookkeeping