Top Risks

• Privacy policy is Google's generic policy — no extension-specific data handling disclosure; privacy pillar maxed at 10.
• cookies permission + content script on WhatsApp Web enables session token harvesting and message interception.
• new Function() constructor in app.js allows dynamic code execution; three innerHTML DOM-XSS sinks across files.
• Free-webmail developer (gmail.com) with no verified publisher badge and no business domain raises accountability concerns.
• No CSP defined (csp_present=false) amplifies DOM-XSS risk from innerHTML sinks in content scripts injected into WhatsApp.

Evidence

• privacy_policy_generic store PP URL is Google's own account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy score.
• free_webmail_developer store Developer email coderlicences@gmail.com is free webmail; no verified publisher badge; developer_domain_info=null.
• cookies_permission_whatsapp manifest cookies permission + host_permission on web.whatsapp.com enables reading WhatsApp session cookies.
• function_constructor_dynamic_eval crx new Function() constructor found in app.js — dynamic code execution vector.
• dom_xss_sinks crx innerHTML assignments from variables in app.js, background.js, contentScript.js with no CSP guard.
• no_csp manifest content_security_policy is null; csp_present=false. Amplifies XSS risk from innerHTML sinks.
• external_js_hosts crx Extension references notiflix.github.io and reactjs.org as external JS hosts — external dependency risk.
• backend_host_access manifest host_permission to app.coderlicences.com (unverified free-webmail dev domain) could be used for data exfil.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Allows large local storage; low standalone risk.
• tabs medium Can read tab URLs and metadata across browsing session.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com but still sensitive.
• notifications low Can display desktop notifications; low abuse potential alone.
• declarativeNetRequest medium Can block/redirect network requests via declarative rules.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; content scripts injected here.
• https://app.coderlicences.com/* medium Host access to developer's own backend; could exfiltrate WhatsApp data.

Pillar Scores

Bookkeeping