Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Teams CRM [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail dev, no developer name, brand impersonation of 'Teams' (Microsoft) — identity unverifiable.
• cookies + WhatsApp host access: WhatsApp session cookies can be read/exfiltrated.
• Privacy policy is Google's generic account policy — does not scope this extension at all.
• No CSP + innerHTML sinks in 3 files + function_constructor = DOM-XSS risk on WhatsApp DOM.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'teams'; dev domain is gmail.com, confirmed_owner=false.
• free_webmail_dev_no_name store Developer email salesteams.rj@gmail.com; developer_name empty; no business website.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_high_risk_host manifest cookies permission + host_permission https://web.whatsapp.com/* enables WhatsApp session cookie access.
• no_csp crx csp_present=false; DOM innerHTML sinks in app.js, background.js, contentScript.js without CSP protection.
• function_constructor crx new Function() call in app.js — dynamic code execution vector.
• install_perm_anomaly api 484 installs, small_install_high_perm=true; high-capability extension with minimal user base.
• unknown_licensing_backend manifest host_permission https://app.coderlicences.com/* — unverified third-party backend; data exfil surface.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Teams CRM [credential-theft] + malext.io malicious_extension_sentry; score 4.66 -> 7.16 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Extends storage quota; low standalone risk.
• tabs medium Can read tab URLs and metadata across sessions.
• cookies high Can read/write cookies; paired with WhatsApp host — session hijack risk.
• notifications low Display notifications; limited risk without host access.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• https://web.whatsapp.com/* high Full host access to WhatsApp web; cookies+host = session data exposure.
• https://app.coderlicences.com/* medium Unknown third-party licensing backend; data exfil surface.

Pillar Scores

Bookkeeping