Top Risks

• Gmail developer with no verified publisher; privacy policy is Google's generic policy, not extension-scoped.
• cookies permission scoped to WhatsApp — can read WhatsApp session tokens and chat cookies.
• Content script injected into WhatsApp with innerHTML DOM sinks and new Function() — XSS attack surface.
• No CSP declared (MV3 relaxed default); innerHTML sinks scored at elevated +2.0 each under FIX B.
• External JS hosts (notiflix.github.io, reactjs.org) listed; no CSP to constrain them.

Evidence

• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• cookies_on_whatsapp manifest cookies permission + host_permission https://web.whatsapp.com/* enables WhatsApp session-token access.
• dom_xss_sinks_no_csp crx 3x innerHTML sinks across app.js, background.js, contentScript.js; csp_present=false → +2.0 each (FIX B).
• function_constructor crx new Function() in app.js qualifies as function_constructor → +2.5 code quality.
• free_webmail_dev store Developer email coderlicences@gmail.com; no verified publisher, no business website.
• external_js_hosts manifest js_external_hosts: notiflix.github.io, reactjs.org; no CSP to pin them.
• no_bad_hosts_no_monetization api threat_intel shows empty bad_host_hits, monetization_hits, affiliate_hits — no threat-intel hits.
• recently_updated store months_since_update=0; maintenance pillar 0.0.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Extends storage quota; no direct data exfil risk on its own.
• tabs medium Can read tab URLs and metadata across browsing session.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com only.
• notifications low Can push desktop notifications; low direct harm.
• declarativeNetRequest medium Can block/redirect network requests; no host-access amplifier here.
• https://web.whatsapp.com/* high Content script + cookie access on WhatsApp; can intercept messages and session tokens.
• https://app.coderlicences.com/* medium Dev-controlled backend; outbound requests to own server expected but unaudited.

Pillar Scores

Bookkeeping