Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WA Sales [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail developer, no verified publisher, no developer name: unaccountable identity accessing WhatsApp Web cookies.
• Privacy policy is Google's generic account policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• function_constructor + multiple innerHTML sinks across app.js, background.js, contentScript.js with no CSP — XSS risk.
• Contacts third-party licensing server (app.coderlicences.com) with cookie permission on WhatsApp session.

Evidence

• free_webmail_dev_no_name store Developer email is contato.wasales@gmail.com with no developer name listed — unverifiable identity.
• generic_privacy_policy store Privacy URL points to Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() constructor found in app.js — dynamic code execution risk.
• dom_sink_innerhtml_userctrl_no_csp crx innerHTML sinks in app.js, background.js, contentScript.js with csp_present=false — elevated DOM-XSS risk.
• cookies_on_whatsapp manifest cookies permission + content_script on web.whatsapp.com — can read WhatsApp session cookies.
• third_party_licensing_host manifest host_permission app.coderlicences.com is an unknown third-party server contacted by extension with cookie access.
• install_perm_anomaly api 67 installs with high-tier permissions flagged as small_install_high_perm=true.
• no_csp_mv3 manifest content_security_policy is null; no CSP declared, amplifying code-quality risk from dynamic execution findings.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WA Sales [data-theft] + malext.io malicious_extension_sentry; score 5.44 -> 7.94 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• unlimitedStorage low Allows large local storage; minor risk of disk abuse.
• tabs medium Can read tab URLs and metadata across active tabs.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com but still high risk.
• notifications low Can display notifications; nuisance potential only.
• declarativeNetRequest medium Can modify network requests declaratively; lower risk than webRequest but still impactful.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including session data and messages.
• https://app.coderlicences.com/* medium Contacts unknown third-party licensing server; unclear data flows.

Pillar Scores

Bookkeeping