Top Risks

• WhatsApp impersonation: unverified gmail dev uses WhatsApp brand without authorization.
• Privacy policy not scoped to this extension and has no data-collection disclosure.
• Free-webmail developer (gmail) with no verified business identity — elevated takeover risk.
• Content script on WhatsApp Web can read all chat messages and page content.
• Install URL hijack opens web.whatsapp.com on install — mild install-time redirect behavior.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer_domain=gmail.com, confirmed_owner=false.
• free_webmail_developer store Developer email wl.exten.04@gmail.com — free webmail, no verified business domain.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false — generic site policy, not extension-specific.
• content_script_whatsapp manifest content_scripts_matches=['https://web.whatsapp.com/*'] — full DOM access to all WhatsApp chats.
• install_url_hijack crx install_url_hijack=true; target=https://web.whatsapp.com on extension install.
• dom_xss_sink crx innerHTML user-controlled sink in vendor.DzFEYc3-.js; no CSP present (MV3 default protects somewhat).
• no_csp manifest content_security_policy=null; csp_present=false on MV3 (strict default applies, but no explicit hardening).
• very_low_installs store Only 3 installs; unverified publisher; numbered-alias-style dev email pattern.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low exfil risk alone.
• storage low Standard key-value store; no cross-site risk.
• tabs medium Can read tab URLs and titles; moderate info exposure.
• alarms low Scheduling only; minimal risk.
• content_scripts:https://web.whatsapp.com/* medium Injected into WhatsApp Web — can read/modify all chat content.

Pillar Scores

Bookkeeping