Top Risks

• Free-webmail Gmail dev with generic alias 'ext.user001'; no verified identity or business presence.
• WhatsApp brand impersonation confirmed (brand_mention.is_impersonation=true, not verified publisher).
• Privacy policy not scoped to this extension; data_collection field false but scope_extension false → +9.0.
• Content script on web.whatsapp.com can read/modify WhatsApp messages; no CSP on MV3 extension.
• innerHTML DOM-XSS sink in vendor bundle with no CSP raises injection risk in WhatsApp context.

Evidence

• brand_impersonation store brand_mention: WhatsApp mentioned, confirmed_owner=false, is_impersonation=true; dev domain is gmail.com.
• free_webmail_dev store Developer email ivanilopes790@gmail.com with generic alias ext.user001; no business website linkable.
• privacy_policy_not_scoped api Policy fetched from hiperchat.com.br; scope_extension=false, data_collection=false → +9.0 privacy score.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://web.whatsapp.com (low severity but present).
• dom_xss_sink crx innerHTML assignment in vendor.DzFEYc3-.js; no CSP to mitigate DOM-XSS in WhatsApp Web context.
• no_csp manifest content_security_policy=null on MV3 extension; default MV3 CSP applies but no explicit hardening.
• whatsapp_content_script manifest Content script injected into https://web.whatsapp.com/*; can access message DOM and user data.
• third_party_silence api Privacy policy does not mention third-party data sharing (third_party_silence=true); +1.0 privacy.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm but enables persistent data hoarding.
• storage low Standard key-value storage; low risk in isolation.
• tabs medium Can read tab URLs/titles; moderate risk for browsing-history inference.
• alarms low Schedules background tasks; low risk on its own.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages and DOM on that origin.

Pillar Scores

Bookkeeping