Top Risks

• Content script on web.whatsapp.com can read all WhatsApp messages; combined with 6+ AI API endpoints, message exfil is plausible.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free Gmail account with no developer name; WhatsApp brand impersonation flagged.
• Install URL hijack opens web.whatsapp.com on install — minor but indicative of low governance.
• AI extension sending WhatsApp content to multiple external AI providers (OpenAI, Anthropic, Gemini, Cohere, Groq, Mistral, DeepSeek, xAI).

Evidence

• whatsapp_content_script manifest Content script injected into web.whatsapp.com/* — full DOM/message read access.
• multi_ai_host_permissions manifest 7 AI API endpoints declared; js_external_hosts adds api.deepseek.com and api.x.ai beyond manifest host_permissions.
• generic_google_privacy_policy store Privacy policy URL points to myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email is watoolsmarketing@gmail.com; developer_name is empty.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, not Meta/WhatsApp.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — minor governance signal.
• dom_xss_sink crx innerHTML assignment from variable in content.js; CSP present so DOM-XSS risk partially mitigated.
• verified_publisher_gmail store Verified publisher badge but email is free Gmail — verification scope limited.

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• activeTab low Scoped to active tab on user action only.
• identity low OAuth token access; risk limited without broad scopes declared.
• alarms low Background scheduling, minimal risk.
• notifications low Can display notifications; low direct data risk.
• unlimitedStorage low Allows large local storage; no exfil risk alone.
• https://web.whatsapp.com/* high Content script on WhatsApp — can read all messages and DOM.
• https://wasubo.com/* low Dev-owned backend; expected for extension functionality.
• https://v3.wasubo.com/* low Dev-owned API subdomain; expected.
• https://api.openai.com/* medium Sends data to OpenAI — potential message content exfil.
• https://api.anthropic.com/* medium Sends data to Anthropic AI — potential message content exfil.
• https://generativelanguage.googleapis.com/* medium Sends data to Google Gemini — potential message content exfil.
• https://api.cohere.ai/* medium Sends data to Cohere AI — potential message content exfil.
• https://api.groq.com/* medium Sends data to Groq AI — potential message content exfil.
• https://api.mistral.ai/* medium Sends data to Mistral AI — potential message content exfil.

Pillar Scores

Bookkeeping