Top Risks

• Brand impersonation: mentions 'ChatGPT' in description but is not affiliated — is_impersonation=true.
• Install URL hijack opens wasii.dev tracking URL on install (utm_source=chrome_extension).
• Uninstall URL hijack configured — behavioural monetization signal.
• Privacy policy admits data_collection=true and third_party_sharing=true with no retention disclosure.
• 5x innerHTML DOM-XSS sinks with no CSP; scripting permission on vu.edu.pk LMS (credentials/quiz data).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['chatgpt']; confirmed_owner=false.
• install_url_hijack crx onInstalled opens https://wasii.dev/firewall-bypass-vu/successful-installed?utm_source=chrome_extension.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — monetization/tracking pattern.
• privacy_policy_third_party_sharing api policy fetched; scope_extension=true; data_collection=true; third_party_sharing=true; retention=false.
• dom_xss_sinks_no_csp crx 5 innerHTML sinks across inject_ui.js, todo-calendar.js, gdb-markdown-copy.js, gpa-calculator.js; csp_present=false.
• external_host_diversity crx 12 external JS hosts across IN/PK/TW; includes github.com, drive.google.com, whatsapp.com, youtu.be.
• no_developer_name store developer_name is empty string; only email support@wasii.dev visible.
• ai_page_content_processing store Description explicitly mentions ChatGPT/AI quiz solving on university LMS pages — AI processing of user content.

Permissions Breakdown

• activeTab low Scoped to current tab on user action; limited blast radius.
• contextMenus low Adds right-click menu items; no data access alone.
• scripting medium Allows JS injection into pages; elevated risk when paired with host perms.
• storage low Local extension data storage; low standalone risk.
• *://*.vulms.vu.edu.pk/* medium Full access to university LMS — credentials, quiz data, student PII in scope.
• *://*.wasii.dev/* low Dev-controlled domain; expected for API calls.

Pillar Scores

Bookkeeping