Top Risks

• Google's generic privacy policy used — admits data collection and 3rd-party sharing with no extension-specific scope.
• Content script on web.whatsapp.com with cookies permission can exfiltrate WhatsApp session and message data.
• Free-webmail developer (Gmail) with no verified business identity raises accountability concerns.
• function_constructor and multiple innerHTML DOM-XSS sinks in app.js, background.js, and contentScript.js with no CSP.
• Small install count (25) combined with high-tier permissions is a tail-attack-surface anomaly.

Evidence

• generic_privacy_policy store Privacy URL is Google's account policy — scope_extension=false, data_collection=true, third_party_sharing=true. Scores +10.0 per v3.5 rule D.
• free_webmail_developer store Developer email coderlicenses@gmail.com; no verified publisher badge; no business domain confirmed.
• cookies_on_whatsapp manifest cookies permission + content_script on web.whatsapp.com enables full session/message read access.
• function_constructor crx new Function() constructor detected in app.js — high-risk dynamic code execution path.
• dom_sink_innerhtml crx innerHTML user-controlled sinks in app.js, background.js, contentScript.js; csp_present=false amplifies risk.
• no_csp manifest content_security_policy is null; MV3 default helps but DOM sinks + Function() remain unmitigated.
• install_perm_anomaly api Only 25 installs but has_high_tier_permission=true; small_install_high_perm=true per pre-computed data.
• js_external_hosts crx Extension references notiflix.github.io and reactjs.org externally — network reach beyond dev backend.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Expands quota but no exfil capability on its own.
• tabs medium Can read tab URLs and titles; moderate surveillance risk.
• cookies high Can read/write cookies; scoped to host_permissions but still high-impact.
• notifications low Push notifications; limited harm without broad host access.
• declarativeNetRequest medium Can modify/block network requests; less risky than webRequest but notable.
• host:https://web.whatsapp.com/* high Content script on WhatsApp; can read/write all messages and session cookies.
• host:https://app.coderlicences.com/* medium Dev backend; data could be transmitted here; unverifiable domain.

Pillar Scores

Bookkeeping