Top Risks

• Brand impersonation: extension targets WhatsApp but developer is unverified free-webmail gmail user with no business identity.
• Privacy policy admits data collection and third-party sharing but is not scoped to this extension (1548-char generic policy).
• Uninstall URL hijack flag set; extension hooks chrome.runtime.setUninstallURL to third-party destination.
• cookies permission + WhatsApp content script = potential WhatsApp session token exfiltration to developer backend.
• Small install count (106) with high-tier permissions signals tail-attack-surface / sleeper risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['whatsapp']; developer domain is gmail.com, not Meta/WhatsApp.
• uninstall_url_hijack crx uninstall_url_hijack=true; sets post-uninstall URL to third-party; monetization/tracking signal.
• privacy_policy_inadequate api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true, retention=false. D rule → +10.0.
• free_webmail_dev_no_business store Developer email think4coding@gmail.com; developer_name empty; no verified publisher; no business domain.
• install_perm_anomaly api 106 installs, has_high_tier_permission=true, small_install_high_perm=true.
• cookies_plus_whatsapp_content_script manifest cookies permission + content_scripts on web.whatsapp.com/* enables session token and message access.
• localhost_host_permission manifest http://localhost:8001/* host permission allows communication with local services, potential data exfil bridge.
• no_csp crx content_security_policy=null; MV3 provides strict default but no explicit extension-level CSP hardening.

Permissions Breakdown

• storage low Persists extension state locally; low standalone risk.
• cookies high Can read/write cookies; combined with WhatsApp content script enables session token access.
• host: http://localhost:8001/* medium Talks to local service; may enable data bridge to local apps outside sandbox.
• host: https://wabulksender.extmagic.com/* medium Calls developer backend; privacy policy admits 3rd-party data sharing.
• content_scripts: *://web.whatsapp.com/* high Injects JS into WhatsApp Web; can read all messages and contacts.

Pillar Scores

Bookkeeping