Top Risks

• Brand impersonation: extension uses 'WhatsApp' branding but developer is unverified free-webmail account with no confirmed ownership.
• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: highest privacy risk tier.
• Developer identity: no dev name, numbered-alias gmail (wopzaryikdzw4@gmail.com), no business domain, no verified publisher badge.
• content_scripts declared for <all_urls> while host_permissions scoped to web.whatsapp.com — scope mismatch raises injection surface concern.
• new Function() constructor in inject.js enables dynamic code execution; no CSP on MV3 extension to mitigate.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=['whatsapp']; confirmed_owner=false; dev domain is gmail.com.
• free_webmail_dev_no_business manifest developer_email=wopzaryikdzw4@gmail.com; developer_name empty; no business website; numbered alias pattern.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• content_scripts_all_urls_mismatch manifest content_scripts_matches=[<all_urls>] but host_permissions only covers web.whatsapp.com — scope mismatch +1.0.
• function_constructor_code_finding crx inject.js contains new Function() constructor; dynamic code execution risk with no CSP guard.
• no_csp manifest csp_present=false; content_security_policy=null on MV3 extension; v2 fix (b) N/A for MV3 but amplifies code risk.
• installs_30k store 30,000 installs; +1.0 webstore reach signal applied.
• no_verified_publisher store verified_publisher=false; is_featured_by_google=false; no trust discounts available.

Permissions Breakdown

• activeTab low Grants access only to the currently active tab on user action.
• storage low Stores local extension data; low standalone risk.
• scripting medium Allows programmatic script injection; elevated when paired with host_permissions.
• host_permissions: *://web.whatsapp.com/* medium Scoped to WhatsApp Web only; can read/modify all content on that origin.
• content_scripts_matches: <all_urls> high Content script declared for all URLs despite host_permissions being narrow — scope mismatch.

Pillar Scores

Bookkeeping