Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DCLeads Web Plus [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Cookie access on WhatsApp domain risks session/message exfiltration.
• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing.
• DOM innerHTML sinks in content script running on WhatsApp with no CSP — XSS attack surface.
• new Function() constructor in app.js enables dynamic code execution.

Evidence

• cookies+whatsapp_host manifest cookies permission + content_scripts on web.whatsapp.com allows reading WhatsApp session cookies and DOM.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; admits data collection & sharing.
• dom_sink_no_csp crx innerHTML assignments in app.js, background.js, contentScript.js with csp_present=false — DOM XSS risk.
• function_constructor crx new Function() in app.js allows dynamic code execution at runtime.
• free_webmail_developer store Developer email carlosdecole@gmail.com; no verified publisher, no business domain.
• small_install_high_perm api Only 70 installs with HIGH-tier permissions (cookies, tabs, WhatsApp host) — tail attack surface.
• js_external_hosts crx Extension references notiflix.github.io and reactjs.org as external JS hosts.
• no_csp manifest content_security_policy is null on MV3 extension; amplifies DOM-sink and dynamic-code risks.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DCLeads Web Plus [data-theft] + malext.io malicious_extension_sentry; score 5.14 -> 7.64 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• unlimitedStorage low Expands storage quota; minimal security impact.
• tabs medium Can read tab URLs and metadata across the browser.
• cookies high Can read/write cookies; combined with host access poses session-theft risk.
• notifications low Displays notifications; limited direct harm.
• declarativeNetRequest medium Can block/redirect network requests per ruleset.
• https://web.whatsapp.com/* high Content script on WhatsApp; can read messages and DOM data.
• https://app.coderlicences.com/* medium Access to an external licensing server; unknown trust level.

Pillar Scores

Bookkeeping