Top Risks

• Cookie access on WhatsApp Web combined with content script enables WhatsApp session hijack.
• Privacy policy is Google's generic policy — does not describe this extension's data practices.
• No CSP; DOM-XSS sinks (innerHTML) in content script and background without sanitization guards.
• new Function() constructor in app.js is a code-execution risk, elevated without CSP.
• Free-webmail developer (gmail), unverified publisher, low install count with high-tier permissions.

Evidence

• cookies + whatsapp host_permission manifest cookies permission scoped to web.whatsapp.com allows reading WhatsApp session cookies.
• generic Google privacy policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no CSP crx content_security_policy is null; csp_present=false; MV3 default applies but no explicit hardening.
• dom_sink_innerhtml_userctrl x3 + no CSP crx innerHTML sinks in app.js, background.js, contentScript.js without CSP — DOM-XSS risk elevated.
• function_constructor crx new Function() in app.js; dynamic code execution risk.
• free-webmail developer, unverified store Developer email leonardoaires.cba@gmail.com; not verified publisher; no business domain.
• small_install_high_perm anomaly api 447 installs with cookies + tabs + declarativeNetRequest flags tail-attack surface.
• external JS hosts crx js_external_hosts: notiflix.github.io, reactjs.org — CSP-allowable remote script sources without explicit policy.

Permissions Breakdown

• storage low Local data persistence; standard for CRM apps.
• unlimitedStorage low Expanded local storage quota; low direct risk.
• tabs medium Can read tab URLs and titles across sessions.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com but still high-risk.
• notifications low System notifications; limited risk.
• declarativeNetRequest medium Can modify/block network requests via declared rules.
• https://web.whatsapp.com/* high Full access to WhatsApp Web DOM and session data.
• https://app.coderlicences.com/* medium Unknown third-party licensing domain; unverified ownership.

Pillar Scores

Bookkeeping