Top Risks

• Cookies permission scoped to WhatsApp Web: could exfiltrate session tokens to coderlicences.com backend.
• Privacy policy is Google's generic account policy — no scope to this extension, admits data collection and 3rd-party sharing.
• No CSP: new Function() constructor and multiple innerHTML sinks in WhatsApp content script create XSS risk.
• Free-webmail developer (coderlicences@gmail.com) with no verified business identity; no publisher badge.
• Small install base (14) with high-tier permissions — tail attack surface anomaly flagged.

Evidence

• free_webmail_developer store Dev email coderlicences@gmail.com; no verified publisher badge; no business domain.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_on_whatsapp manifest cookies permission + host https://web.whatsapp.com/* allows WhatsApp session cookie access.
• function_constructor crx new Function() in app.js; no CSP to mitigate dynamic code execution.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in app.js, background.js, contentScript.js with csp_present=false.
• js_external_hosts crx Extension references notiflix.github.io and reactjs.org as external JS hosts.
• install_perm_anomaly api 14 installs with high-tier permissions (cookies, tabs, declarativeNetRequest) — small_install_high_perm=true.
• no_csp manifest content_security_policy is null (MV3 default CSP applies but no custom hardening).

Permissions Breakdown

• storage low Standard local data persistence.
• unlimitedStorage low Extended storage quota; low standalone risk.
• tabs medium Can enumerate open tabs and URLs.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com.
• notifications low Can show desktop notifications; limited impact.
• declarativeNetRequest medium Can block/redirect network requests via static rules.
• https://web.whatsapp.com/* high Full access to WhatsApp Web session including messages and cookies.
• https://app.coderlicences.com/* medium Access to developer-owned backend; data exfil surface.

Pillar Scores

Bookkeeping