Top Risks

• Free-webmail Gmail developer with no verified publisher badge raises identity accountability concerns.
• WhatsApp brand impersonation: confirmed_owner=false, developer not affiliated with Meta.
• Privacy policy not scoped to this extension and does not disclose data collection; third-party sharing silence.
• Content script on web.whatsapp.com can read all chat messages; innerHTML sink with no CSP amplifies XSS risk.
• Install URL hijack opens web.whatsapp.com on install; minor but indicates onboarding manipulation.

Evidence

• free_webmail_developer store Developer email wl.exten.02@gmail.com is a free-webmail numbered alias; no verified business identity.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, not Meta.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false, third_party_silence=true.
• dom_sink_innerhtml_no_csp crx innerHTML user-controlled sink in vendor.js; csp_present=false amplifies DOM-XSS risk.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://web.whatsapp.com (3rd-party URL).
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* allowing full DOM access to chats.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• js_external_hosts crx External JS hosts: hc-stt.hiperchat.com.br, reactjs.org, web.whatsapp.com; reactjs.org is CDN-like.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk on its own.
• storage low Standard key-value storage; minimal risk.
• tabs medium Can read tab URLs and metadata; moderate risk.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify chat content.

Pillar Scores

Bookkeeping