Top Risks

• cookies permission on WhatsApp Web: full session token access for all connected accounts
• Privacy policy is Google's own generic policy — not scoped to this extension at all (D rule: +10)
• function_constructor + 3x innerHTML DOM-XSS sinks in content/background scripts with no CSP
• Free-webmail developer (gmail), no developer name, no business website — unverifiable identity
• Small install count (16) with high-tier permissions: elevated tail-attack-surface risk

Evidence

• cookies+WhatsApp host manifest cookies permission + content_scripts on web.whatsapp.com/* enables full WhatsApp session token exfiltration.
• generic privacy policy store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• function_constructor crx new Function() in app.js — dynamic code execution capability (+2.5 code quality).
• dom_sink_innerhtml_userctrl x3 crx innerHTML sinks in app.js, background.js, contentScript.js with csp_present=false → +2.0 each trigger.
• no CSP + MV3 manifest content_security_policy is null; no CSP hardens risk of existing DOM sinks.
• free-webmail dev, no name store Developer sowatbrasil@gmail.com with empty developer_name — floor reputation at 7.5.
• install_perm_anomaly api 16 installs with high-tier permission (cookies) — small_install_high_perm=true (+1.5 webstore).
• external JS hosts crx js_external_hosts: notiflix.github.io, reactjs.org — 2 external CDN references in JS files.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Allows large local storage; minimal standalone risk.
• tabs medium Can read tab URLs and titles; moderate surveillance surface.
• cookies high Can read/write cookies; high risk for session hijacking.
• notifications low Can display notifications; low risk without broad host access.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session cookies.
• https://app.coderlicences.com/* medium Access to developer's own licensing backend; less transparent.

Pillar Scores

Bookkeeping