Top Risks

• Privacy policy URL unreachable (fetch error) — treated as no policy; 10.0 privacy score.
• Free-webmail Gmail dev with WhatsApp brand impersonation and no verified publisher status.
• Content script injected into web.whatsapp.com can read/modify all WhatsApp Web messages.
• install_url_hijack redirects to web.whatsapp.com on install — minor hijack signal present.
• dom_sink_innerhtml_userctrl in vendor JS with no CSP — elevated XSS risk on WhatsApp page.

Evidence

• privacy_policy_fetch_error api Privacy policy URL returned ConnectionError; treated as fetched==false → privacy pillar 10.0.
• brand_impersonation store WhatsApp brand mentioned; developer domain gmail.com, confirmed_owner=false, is_impersonation=true.
• free_webmail_developer store Developer email wl.exten.09@gmail.com; no verified publisher, no business website confirmed.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com — opens 3rd-party URL on install.
• content_script_whatsapp manifest Content script injected on https://web.whatsapp.com/* giving full DOM access to messaging app.
• dom_sink_innerhtml_no_csp crx innerHTML sink in vendor.DzFEYc3-.js with csp_present=false; DOM-XSS risk elevated.
• no_csp_mv3 manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• maintenance_3_6_months store months_since_update=6; borderline 3-6mo band → +1.5 maintenance score.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; no direct data-exfil risk alone.
• storage low Standard key-value storage; low risk.
• tabs medium Can read tab URLs/titles; moderate privacy surface.
• alarms low Scheduling only; minimal risk.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages and DOM.

Pillar Scores

Bookkeeping