Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Wasubot - Chatbot - Marketing - Conversation Flows [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Content script on web.whatsapp.com can read all WhatsApp messages; combined with 6+ AI API endpoints, message exfil is plausible.
• Privacy policy is Google's generic account policy — not scoped to this extension, admits data collection and third-party sharing.
• Developer uses free Gmail account with no developer name; WhatsApp brand impersonation flagged.
• Install URL hijack opens web.whatsapp.com on install — minor but indicative of low governance.

Evidence

• whatsapp_content_script manifest Content script injected into web.whatsapp.com/* — full DOM/message read access.
• multi_ai_host_permissions manifest 7 AI API endpoints declared; js_external_hosts adds api.deepseek.com and api.x.ai beyond manifest host_permissions.
• generic_google_privacy_policy store Privacy policy URL points to myaccount.google.com — scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_dev_no_name store Developer email is watoolsmarketing@gmail.com; developer_name is empty.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, not Meta/WhatsApp.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — minor governance signal.
• dom_xss_sink crx innerHTML assignment from variable in content.js; CSP present so DOM-XSS risk partially mitigated.
• verified_publisher_gmail store Verified publisher badge but email is free Gmail — verification scope limited.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Wasubot - Chatbot - Marketing - Conversation Flows [data-theft] + malext.io malicious_extension_sentry; score 4.44 -> 6.94 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• activeTab low Scoped to active tab on user action only.
• identity low OAuth token access; risk limited without broad scopes declared.
• alarms low Background scheduling, minimal risk.
• notifications low Can display notifications; low direct data risk.
• unlimitedStorage low Allows large local storage; no exfil risk alone.
• https://web.whatsapp.com/* high Content script on WhatsApp — can read all messages and DOM.
• https://wasubo.com/* low Dev-owned backend; expected for extension functionality.
• https://v3.wasubo.com/* low Dev-owned API subdomain; expected.
• https://api.openai.com/* medium Sends data to OpenAI — potential message content exfil.
• https://api.anthropic.com/* medium Sends data to Anthropic AI — potential message content exfil.
• https://generativelanguage.googleapis.com/* medium Sends data to Google Gemini — potential message content exfil.
• https://api.cohere.ai/* medium Sends data to Cohere AI — potential message content exfil.
• https://api.groq.com/* medium Sends data to Groq AI — potential message content exfil.
• https://api.mistral.ai/* medium Sends data to Mistral AI — potential message content exfil.

Pillar Scores

Bookkeeping