Top Risks

• Cookies + content_script on web.whatsapp.com: can exfiltrate WhatsApp session tokens and messages.
• Privacy policy is Google's generic account policy — no scope to this extension; data practices undisclosed.
• new Function() constructor + three innerHTML sinks with no CSP: elevated XSS/code-execution risk.
• Gmail developer account, no developer name, no verified publisher — minimal accountability.
• Small install base (40) with high-tier permissions is a tail-attack-surface signal.

Evidence

• cookies_on_whatsapp manifest cookies permission + host_permission https://web.whatsapp.com/* allows reading WhatsApp session cookies.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() in app.js — dynamic code execution path present without CSP guard.
• dom_xss_sinks crx innerHTML sinks in app.js, background.js, contentScript.js with no content_security_policy set.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• free_webmail_dev_no_name store Developer email coderlicences@gmail.com; developer_name empty; no verified publisher badge.
• small_install_high_perm api install_perm_anomaly: 40 installs with high-tier permissions (cookies, declarativeNetRequest, tabs).
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — CDN references in JS but no CSP to pin them.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Allows large local storage; low incremental risk.
• tabs medium Can read tab URLs and titles across all open tabs.
• cookies high Can read/write cookies; scoped to host_permissions but still sensitive.
• notifications low System notifications; minor abuse potential.
• declarativeNetRequest medium Can modify network requests declaratively; less dangerous than webRequest but notable.
• https://web.whatsapp.com/* high Content script + cookies on WhatsApp; can read messages and session cookies.
• https://app.coderlicences.com/* medium Dev-controlled backend endpoint; all data transits this domain.

Pillar Scores

Bookkeeping