Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection & 3rd-party sharing (+10 privacy pillar).
• WhatsApp brand impersonation: confirmed_owner=false, developer on free Gmail, no verified publisher (+2.0 reputation).
• Free-webmail developer with no business website — accountability gap drives reputation pillar to 8.5.
• Uninstall URL hijack flagged; install_url_hijack opens web.whatsapp.com on install (+3.0 webstore).
• Extension contacts www.watoolshub.online (unverified domain) despite claiming 100% local/no-server operation — description mismatch.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user, confirmed_owner=false.
• privacy_policy_generic store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5-D).
• uninstall_url_hijack crx uninstall_url_hijack=true; target null. Webstore +3.0 per rubric.
• install_url_hijack crx install_url_hijack=true targeting web.whatsapp.com. Webstore +2.0.
• external_host_mismatch crx www.watoolshub.online in js_external_hosts contradicts '100% local, no servers' description claim.
• free_webmail_developer store Developer email sabirhusseinvlc@gmail.com; no verified publisher, no featured badge, no business domain.
• host_geo_diversity api 3 countries (CA, IN, US) — below +1.5 threshold of 4; no penalty applied.
• cve_findings_empty crx No CVEs detected in bundled libraries; cve_pillar_score=0.

Permissions Breakdown

• storage low Local data persistence; aligns with stated local-only CRM function.
• alarms low Background scheduling for reminders; low abuse potential.
• notifications low User-facing alerts; medium risk when paired with host access but narrow here.
• sidePanel low UI surface only; no data exfil risk.
• tabs medium Can read tab URLs/titles; limited to declared host patterns in practice.
• windows low Window management; low standalone risk.
• https://web.whatsapp.com/* medium Content access to WhatsApp Web; matches stated CRM purpose but sensitive.
• https://extensionpay.com/* low Payment provider; scoped and expected for paid extension.

Pillar Scores

Bookkeeping