Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Anjos Zap [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• cookies permission on web.whatsapp.com allows reading WhatsApp session tokens
• Privacy policy is Google's own generic policy — not scoped to this extension at all
• new Function() constructor + 3x innerHTML sinks with no CSP raises DOM-XSS risk
• Free-webmail developer (Gmail), no developer name, no verified publisher — unaccountable

Evidence

• cookies_on_whatsapp manifest cookies permission + host_permissions https://web.whatsapp.com/* allows session cookie access.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() in app.js — dynamic code execution risk without CSP.
• dom_xss_sinks crx innerHTML used in app.js, background.js, contentScript.js with no CSP present.
• free_webmail_no_devname store Developer email coderlicences@gmail.com, developer_name empty, not verified publisher.
• external_js_hosts crx Loads from notiflix.github.io and reactjs.org — external CDN dependencies.
• install_perm_anomaly api Only 322 installs but has high-tier permissions (cookies + WhatsApp full access).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Anjos Zap [data-theft] + malext.io malicious_extension_sentry; score 4.93 -> 7.43 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; low risk alone.
• unlimitedStorage low Allows unlimited local storage; minor resource concern.
• tabs medium Access to tab URLs and metadata; combined with cookies elevates risk.
• cookies high Can read/write cookies on host_permissions scope (WhatsApp session cookies).
• notifications low Display notifications; limited standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; scoped but capable of disruption.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including session data and messages.
• https://app.coderlicences.com/* medium Extension communicates with developer backend; data exfil surface.

Pillar Scores

Bookkeeping