Top Risks

• Privacy policy is Google's generic policy (fetch failed via SSLError) — no extension-scoped data disclosure whatsoever.
• WhatsApp brand impersonation by unverified free-webmail developer (coderlicences@gmail.com); no confirmed ownership.
• cookies permission scoped to web.whatsapp.com allows capture of active WhatsApp session tokens.
• function_constructor (new Function) and multiple innerHTML DOM-XSS sinks found across app.js, background.js, contentScript.js.
• No CSP declared (MV3 default enforced but js_external_hosts include notiflix.github.io/reactjs.org loaded externally).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain is gmail.com, not Meta/WhatsApp.
• free_webmail_dev store Developer email coderlicences@gmail.com; no verified business domain; reputation floor applies.
• privacy_policy_fetch_failed api Privacy policy URL points to Google account policy; fetch failed SSLError; scope_extension=false.
• function_constructor crx new Function() constructor in app.js — dynamic code execution risk.
• dom_xss_sink crx innerHTML from variable in app.js, background.js, contentScript.js — DOM-XSS sinks with no CSP.
• cookies_on_whatsapp manifest cookies permission + host_permission on web.whatsapp.com enables full session token access.
• external_js_hosts crx js_external_hosts include notiflix.github.io and reactjs.org — external CDN load surface.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no accountability signals.

Permissions Breakdown

• storage low Stores local extension data; low risk in isolation.
• unlimitedStorage low Allows large local storage; low risk in isolation.
• tabs medium Can read tab URLs and titles across browser sessions.
• cookies high Can read/write cookies; scoped to whatsapp.com and own backend but still high-risk.
• notifications low Sends desktop notifications; limited abuse surface.
• declarativeNetRequest medium Can modify network requests declaratively; moderate interception risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web page content and session cookies.
• https://app.coderlicences.com/* medium Extension communicates with developer-controlled backend; data exfil surface.

Pillar Scores

Bookkeeping