Top Risks

• Free-webmail dev (gmail) with no verified identity; impersonates WhatsApp brand without authorization.
• Content script on WhatsApp Web can read all message content and DOM; sensitive data exposure.
• Install-URL hijack opens web.whatsapp.com on install — minor but indicative of low-trust practices.
• Privacy policy hosted on opt-api.com, unrelated to developer identity; third-party sharing disclosed.
• innerHTML DOM-XSS sink in vendor bundle with no CSP; XSS risk if attacker influences DOM input.

Evidence

• free_webmail_dev store Developer email wl.exten.04@gmail.com — numbered alias, no business domain.
• brand_impersonation store WhatsApp brand mentioned; developer is gmail user, confirmed_owner=false, is_impersonation=true.
• install_url_hijack manifest install_url_hijack=true; opens https://web.whatsapp.com on install.
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — full DOM/message access.
• dom_xss_sink crx innerHTML user-controlled assignment in vendor.D42Me2hF.js; no CSP present (MV3 default).
• privacy_policy_third_party api Policy at opt-api.com discloses third-party sharing; not dev-owned domain.
• js_external_hosts crx Contacts hc-stt.hiperchat.com.br and reactjs.org externally; 2 countries (BR, US).
• no_installs_no_rating store Only 10 installs, 0 ratings; tail-attack-surface / pre-distribution risk.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct exfil risk.
• storage low Standard key-value storage; minimal risk.
• tabs medium Can read tab URLs and metadata; moderate privacy exposure.
• alarms low Scheduling only; no data access.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM content.

Pillar Scores

Bookkeeping