Top Risks

• Privacy policy URL unreachable (fetch error) — no verifiable data handling disclosure.
• WhatsApp brand impersonation by unverified gmail developer with no confirmed ownership.
• Content script injected into WhatsApp Web can read/modify all chat content.
• Install URL hijack opens web.whatsapp.com on install — low-severity redirect signal.
• Free-webmail developer (gmail), no business website, unverified identity.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL returned ConnectionError; policy cannot be evaluated — scored as not fetched (+10.0).
• brand_impersonation store WhatsApp mentioned in brand_mention; developer domain is gmail.com, confirmed_owner=false, is_impersonation=true.
• free_webmail_developer store Developer email wl.exten.09@gmail.com — numbered alias on free webmail, no business website.
• install_url_hijack manifest install_url_hijack=true; target https://web.whatsapp.com — opens 3rd-party page on install.
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — full read/write access to chat page.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in vendor.BaH-a-x7.js; CSP absent on MV3, CVE list empty.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• reputation_signals store 7 installs, unverified publisher, no featured badge, no recognized org, gmail numbered-alias dev email.

Permissions Breakdown

• unlimitedStorage low Allows extended local storage; low direct harm potential.
• storage low Standard extension storage; low risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• alarms low Background scheduling only; minimal risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages and page content.

Pillar Scores

Bookkeeping