Top Risks

• WhatsApp brand impersonation by unverified free-webmail developer (gmail) with no business domain.
• Privacy policy not scoped to this extension and does not confirm data collection scope.
• Content script on WhatsApp Web can read/modify all messages and user data.
• Install URL hijack opens web.whatsapp.com on install — onInstalled redirect signal.
• DOM-XSS innerHTML sink in vendor JS with no CSP present (MV3 but csp_present==false).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is gmail-based with no confirmed ownership.
• free_webmail_developer store Developer email wl.exten.02@gmail.com — numbered alias pattern, no business domain.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on extension install.
• privacy_policy_not_scoped api Privacy policy fetched but scope_extension=false and data_collection=false — generic non-extension policy.
• dom_xss_sink_no_csp crx innerHTML assignment from variable in vendor.DzFEYc3-.js; csp_present=false amplifies DOM-XSS risk.
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — full read/write access to WhatsApp session.
• js_external_hosts crx External JS hosts: hc-stt.hiperchat.com.br, reactjs.org, web.whatsapp.com — 3 distinct domains.
• no_cve_findings crx cve_findings_raw empty; no CVE exposure detected.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but can cache large data.
• storage low Standard local key-value store; low risk in isolation.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• alarms low Scheduling only; no data access.
• content_scripts_matches:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web — can read/modify messages and contacts.

Pillar Scores

Bookkeeping