Top Risks

• cookies permission + WhatsApp host access enables full session token and message exfiltration.
• Privacy policy is Google's generic policy (scope_extension=false, admits data collection and 3rd-party sharing) — scored 10.0.
• Free-webmail developer (Gmail) with no verified publisher badge; no business domain identity.
• 19 months since last update; stale for an extension handling live chat sessions.
• innerHTML DOM-XSS sink in contentScript.js running inside WhatsApp Web context.

Evidence

• cookies+whatsapp_host manifest cookies permission paired with https://web.whatsapp.com/* enables WhatsApp session token access.
• generic_google_privacy_policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev store Developer email coderlicences@gmail.com; no verified publisher; no business domain.
• stale_extension store Last updated January 2025, 19 months ago; handling sensitive WhatsApp data.
• dom_xss_sink crx innerHTML assigned from variable in contentScript.js running on web.whatsapp.com.
• small_install_high_perm api Only 186 installs but holds cookies + broad WhatsApp host access — tail attack surface.
• js_external_hosts crx Contacts app.coderlicences.com and v1.api.coderlicences.com; reactjs.org listed (CDN reference).
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit lockdown.

Permissions Breakdown

• storage low Standard local persistence; low risk alone.
• unlimitedStorage low Allows large local storage; minor risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• cookies high Can read/write cookies; high risk when paired with host permissions on WhatsApp.
• https://web.whatsapp.com/* high Full access to WhatsApp Web sessions and messages; sensitive context.
• https://app.coderlicences.com/* medium Scoped to developer's own backend; expected for CRM auth but unverified.

Pillar Scores

Bookkeeping