Top Risks

• WhatsApp impersonation: brand_mention.is_impersonation=true, dev not confirmed owner of WhatsApp brand.
• Privacy policy not scoped to this extension and third_party_silence=true; data practices unknown.
• Free-webmail Gmail dev (pietrogabrielg20@gmail.com) with pseudonymous name 'ext.user003', no verified identity.
• Content script runs on web.whatsapp.com DOM; innerHTML sink in vendor JS risks DOM-XSS on message content.
• Install URL hijack opens web.whatsapp.com on install; minor but indicative of low-quality practices.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; dev domain is gmail.com, confirmed_owner=false.
• free_webmail_dev store Developer email pietrogabrielg20@gmail.com; name 'ext.user003' is pseudonymous; no business site.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false, third_party_silence=true.
• dom_xss_sink crx innerHTML assigned from variable in vendor.DzFEYc3-.js; no CSP to mitigate XSS on WhatsApp DOM.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — minor hijack signal.
• content_script_whatsapp manifest content_scripts injected into https://web.whatsapp.com/*; can access message content in DOM.
• no_csp manifest content_security_policy=null; MV3 default CSP applies but no explicit hardening.
• very_low_installs store Only 9 installs; tail-attack-surface risk low by rubric but extension is largely untested.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm potential.
• storage low Standard key-value storage; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Script injection into WhatsApp Web; can read/modify messages in DOM.

Pillar Scores

Bookkeeping