Top Risks

• WhatsApp impersonation: unverified Gmail dev uses WhatsApp brand without authorization.
• Content script on WhatsApp Web can read/exfiltrate all chat messages and contacts.
• Free Gmail dev email with no verified business domain — low accountability.
• DOM-XSS sink (innerHTML) in vendor bundle without CSP; MV3 default CSP is strict but no explicit policy declared.
• Install URL hijack opens web.whatsapp.com on install — minor but indicative of redirection pattern.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is unverified Gmail user, not Meta/WhatsApp.
• free_webmail_developer store Developer email wl.exten.01@gmail.com — numbered alias pattern, no business website.
• content_script_whatsapp manifest content_scripts_matches=['https://web.whatsapp.com/*']; injects into all WhatsApp Web sessions.
• install_url_hijack crx install_url_hijack=true, target=https://web.whatsapp.com on install.
• dom_xss_sink crx innerHTML user-controlled variable in vendor.DzFEYc3-.js; no CSP declared.
• privacy_policy_external_domain store Privacy policy at privacy.opt-api.com — not developer's own domain; scope_extension=true, all fields present.
• js_external_hosts crx External JS hosts: hc-stt.hiperchat.com.br (BR), reactjs.org (US), web.whatsapp.com; 2 countries.
• low_installs store Only 10 installs, 0 ratings — very limited blast radius but no community vetting.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables data hoarding.
• storage low Standard local storage access; no cross-origin concern.
• tabs medium Can read tab URLs/titles; moderate privacy surface.
• alarms low Scheduling only; minimal risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify all chat content on that origin.

Pillar Scores

Bookkeeping