Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (D rule: +10.0 privacy pillar).
• Content script injected into WhatsApp Web with full host access; 9 innerHTML DOM-XSS sinks across core modules with no CSP.
• Free-webmail developer (axbsender@gmail.com) with no verified business identity or publisher badge.
• No CSP declared (MV3 so no +2.0 network penalty, but amplifies DOM-XSS risk across 9 files).
• Very low install count (6) and zero ratings — unvetted by community; difficult to assess real-world behaviour.

Evidence

• privacy_policy_generic_admits_collection store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D +10.0.
• dom_xss_sinks_no_csp crx 9 innerHTML DOM-XSS sinks across CRM, auth, dashboard, mass-send modules; csp_present=false amplifies risk (FIX B).
• whatsapp_host_access manifest host_permissions include *://web.whatsapp.com/* with content_script injection — can read/write all WhatsApp session data.
• free_webmail_dev store Developer email axbsender@gmail.com; no verified publisher badge; no recognised org.
• external_hosts crx 8 external JS hosts including mixkit.co CDN assets, flaticon CDN, fonts.googleapis.com, youtube.com.
• no_cve_findings api cve_findings_raw is empty; no CVE exposure.
• operator_cluster_single api sibling_count=0; no cluster pattern.
• maintenance_recent store months_since_update=1; extension is actively maintained.

Permissions Breakdown

• storage low Standard local data persistence; low risk on its own.
• unlimitedStorage low Expands storage quota; minimal security risk.
• *://web.whatsapp.com/* high Full access to WhatsApp Web — can read messages, contacts, inject code.
• https://axbsender.com.br/* medium Access to developer backend; data exfil surface, but dev-controlled.
• https://www.axbsender.com.br/* medium Same as above (www variant).
• https://api.bcb.gov.br/* low Brazilian central bank public API; read-only financial rates, low risk.

Pillar Scores

Bookkeeping