Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ATENDO DO ZAP [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail developer (gmail) with no verified business identity; unverifiable accountability.
• WhatsApp brand impersonation: unconfirmed owner operates WhatsApp-scoped extension.
• Privacy policy not scoped to this extension and does not confirm what data is collected.
• Content script on WhatsApp Web can read all messages and DOM; innerHTML XSS sink present.

Evidence

• free_webmail_developer store Developer email wl.exten.06@gmail.com; no verified business domain.
• brand_impersonation store brand_mention: WhatsApp mentioned; confirmed_owner=false, is_impersonation=true.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — low-quality practice signal.
• content_script_sensitive_scope manifest Injects into https://web.whatsapp.com/* — full access to chat DOM and messages.
• dom_xss_sink crx innerHTML assigned from variable in vendor.DzFEYc3-.js — DOM-XSS risk without CSP.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false; generic non-scoped policy.
• no_csp manifest content_security_policy is null; no CSP mitigating XSS in injected scripts.
• external_host_reactjs_org crx js_external_hosts includes reactjs.org; remote JS reference in extension context.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ATENDO DO ZAP [data-theft] + malext.io malicious_extension_sentry; score 4.20 -> 6.70 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Local storage quota only; no data exfil risk on its own.
• storage low Standard local/sync storage; low impact.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Scheduling only; minimal risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web — can read/modify messages and DOM.

Pillar Scores

Bookkeeping