Top Risks

• Google privacy policy used instead of extension-specific policy — admits data collection and 3rd-party sharing without any scope to this extension.
• WhatsApp brand impersonation: extension named 'Whatsapp CRM' but developer is unaffiliated gmail user.
• cookies permission on WhatsApp Web enables session token access; combined with developer backend host_permission creates exfil path.
• new Function() constructor and multiple innerHTML sinks in app.js/background.js/contentScript.js with no CSP — DOM-XSS and code-injection risk.
• Free-webmail developer (gmail), no verified publisher, no business website, 110 installs with high-tier permissions — tail-attack-surface anomaly.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user with no confirmed ownership.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• function_constructor crx new Function() in app.js — dynamic code execution risk, scores +2.5 code quality.
• dom_sink_innerhtml crx innerHTML from variable in app.js, background.js, contentScript.js with csp_present=false → elevated DOM-XSS risk.
• cookies_high_perm manifest cookies permission with host_permissions on web.whatsapp.com — session theft surface.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — CSP absent, remote script loading possible.
• install_perm_anomaly api 110 installs + has_high_tier_permission=true + small_install_high_perm=true — tail attack surface.
• free_webmail_developer store coderlicences@gmail.com, no verified publisher, no business website, no featured badge.

Permissions Breakdown

• storage low Standard local data persistence.
• unlimitedStorage low Expanded storage quota, low direct risk.
• tabs medium Can read tab URLs and metadata across browser.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com.
• notifications low Can push desktop notifications.
• declarativeNetRequest medium Can modify network requests declaratively.
• https://web.whatsapp.com/* high Full content access to WhatsApp Web — messages, contacts.
• https://app.coderlicences.com/* medium Outbound access to developer backend; data exfil surface.

Pillar Scores

Bookkeeping