Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WA Manager - Contacts management [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy URL returns HTTP error — policy effectively absent; +10 privacy score.
• Uninstall URL hijack redirects to Google Form; install URL hijack opens leadtools.in — tracking user lifecycle.
• Host permission https://*.google.com/* is overly broad relative to stated WhatsApp-only function.
• Only 13 installs yet featured; extreme tail-attack surface if extension is later transferred or compromised.

Evidence

• privacy_policy_fetch_failed api Privacy policy URL https://leadtools.in/privacy-policy returned HTTPError — policy cannot be evaluated; scored as absent.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL points to docs.google.com form — tracks user uninstall events.
• install_url_hijack crx onInstalled opens https://leadtools.in/wa-manager — lifecycle tracking, potential marketing redirect.
• overbroad_google_host_permission manifest https://*.google.com/* covers Gmail, Drive, Docs etc.; stated function is WhatsApp contact management only.
• whatsapp_content_script_high_sensitivity manifest Content script injected into web.whatsapp.com can read full WhatsApp DOM including contacts and messages.
• developer_backend_endpoint manifest wamanager.leadtools.workers.dev listed in host_permissions and js_external_hosts — unverified outbound backend.
• very_low_install_count store Only 13 installs; featured badge incongruous with install count; anomalous tail-attack surface.
• no_verified_publisher store Developer not verified; featured but unverified status reduces accountability confidence.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WA Manager - Contacts management [credential-theft] + malext.io malicious_extension_sentry; score 2.68 -> 5.18 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; standard for productivity tools.
• scripting medium Can inject scripts into tabs; scoped to WhatsApp host only.
• activeTab low Transient access to active tab; low blast radius.
• downloads medium Can save files to disk; needed for contact export feature.
• tabs medium Can read URLs/titles of all open tabs.
• sidePanel low UI surface only; no data access.
• https://web.whatsapp.com/* high Full access to WhatsApp Web DOM; contacts, messages visible.
• https://chat.whatsapp.com/* medium Access to WhatsApp group invite links.
• https://wa.me/* low WhatsApp deep-link domain; limited content.
• https://*.google.com/* high Broad Google subdomain access; could read Gmail, Drive, etc.
• https://wamanager.leadtools.workers.dev/* medium Developer-controlled backend endpoint; data exfil surface.

Pillar Scores

Bookkeeping