Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — CRM no WhatsApp para Corban [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail developer with no verified identity using Google's own privacy policy — provides zero extension-specific data disclosure.
• WhatsApp impersonation: brand_mention.is_impersonation=true, unverified developer on free webmail.
• cookies + tabs + host access on web.whatsapp.com enables full session and message data exfiltration.
• new Function() constructor and three innerHTML DOM-XSS sinks in content script running inside WhatsApp Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is unverified gmail user, not Meta.
• generic_privacy_policy store Privacy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true) → +10.0 Privacy (v3.5 D).
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher; no business domain → Reputation floor 7.5.
• code_function_constructor crx new Function() in app.js — dynamic code execution; +2.5 Code Quality.
• code_dom_xss_sinks crx innerHTML sinks in app.js, background.js, contentScript.js with no CSP → +2.0 each (FIX B).
• no_csp manifest content_security_policy=null; MV3 default is strict but no explicit CSP amplifies DOM-sink risk.
• cookies_high_risk manifest cookies permission scoped to web.whatsapp.com enables reading WhatsApp session tokens.
• js_external_hosts crx References notiflix.github.io and reactjs.org as external JS hosts — remote CDN loading surface.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — CRM no WhatsApp para Corban [credential-theft] + malext.io malicious_extension_sentry; score 4.96 -> 7.46 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard key-value persistence; low risk.
• unlimitedStorage low Expands storage quota; low direct risk.
• tabs medium Can read tab URLs and metadata; medium risk.
• cookies high Can read/write cookies; dangerous without broad hosts but scoped to whatsapp.com and coderlicences.com.
• notifications low Can push desktop notifications; low risk alone.
• declarativeNetRequest medium Can block/redirect network requests via rules; medium risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Access to developer's backend; data exfil surface.

Pillar Scores

Bookkeeping