Top Risks

• cookies + WhatsApp host access enables full session/message theft from WhatsApp Web
• Privacy policy is Google's own generic policy — does not cover this extension at all
• Developer is free-webmail Gmail with no verified identity or business domain
• DOM-XSS sinks (innerHTML) in content script on WhatsApp with no CSP protection
• new Function() constructor in app.js allows dynamic code execution; no CSP mitigates

Evidence

• cookies + whatsapp host access manifest cookies permission + https://web.whatsapp.com/* host = full session cookie read capability on WhatsApp.
• generic google privacy policy store privacy_policy_url points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail developer store Developer email aldoapvsmt@gmail.com; no business domain; no verified publisher badge.
• innerHTML sinks without CSP crx 3 dom_sink_innerhtml_userctrl findings across app.js, background.js, contentScript.js; csp_present=false.
• function_constructor crx new Function() in app.js; allows dynamic code eval; elevated with no CSP.
• external JS hosts crx js_external_hosts: notiflix.github.io, reactjs.org — remote CDN references in extension.
• small install high perm anomaly api install_perm_anomaly: 20 installs with high-tier permissions (cookies, tabs, declarativeNetRequest).
• unknown licensing endpoint manifest host_permissions include https://app.coderlicences.com/* — unverifiable third-party license server.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Allows large local storage; no direct exfil risk alone.
• tabs medium Can enumerate open tabs and URLs; mild privacy exposure.
• cookies high Can read/write cookies; combined with WhatsApp host access enables session theft.
• notifications low Push notifications; low risk, no data access.
• declarativeNetRequest medium Can modify/block network requests declaratively; moderate traffic-shaping risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Contacts unknown third-party licensing server; data flow unverifiable.

Pillar Scores

Bookkeeping