Top Risks

• Brand impersonation: mentions 'WhatsApp' and 'Google' without confirmed ownership (is_impersonation=true).
• Privacy policy fetched but scope_extension=false and third_party_sharing=true with no retention disclosure — admits 3rd-party sharing without scoping to this extension.
• identity.email permission collects user's Google email; unclear purpose given WhatsApp messaging function.
• No developer display name in listing increases accountability gap.
• Content script injected into WhatsApp Web sessions could intercept sensitive messages if extension is later compromised.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands 'google' and 'whatsapp' mentioned; confirmed_owner=false.
• privacy_policy_generic_with_third_party_sharing api Policy fetched but scope_extension=false, data_collection=false, third_party_sharing=true → v3.5(D) +10.0 privacy score.
• verified_publisher_featured store verified_publisher=true and is_featured_by_google=true; reduces reputation risk but does not resolve impersonation.
• no_developer_name store developer_name is empty string; reduces accountability.
• identity_email_permission manifest identity.email permission declared; collects user Google email address.
• content_script_whatsapp manifest Content script scoped to https://web.whatsapp.com/*; access to live messaging sessions.
• no_csp manifest csp_present=false; MV3 default CSP applies but no explicit policy declared.
• no_cve_no_bad_hosts api cve_findings_raw=[], bad_host_hits=[], monetization_hits=[], affiliate_hits=[] — clean threat intel.

Permissions Breakdown

• storage low Stores local extension data; low risk on its own.
• declarativeNetRequest medium Can modify/block network requests without reading content; scoped risk.
• identity medium Accesses Google OAuth identity; could expose user identity to extension.
• identity.email medium Retrieves the signed-in user's email address; raises privacy concern.
• host: https://web.whatsapp.com/ medium Content script on WhatsApp web; can read/inject into sensitive messaging sessions.

Pillar Scores

Bookkeeping