Top Risks

• Cookies permission + WhatsApp host access: session token and message data exposure risk.
• Google account privacy policy used — not scoped to this extension; admits data collection + 3rd-party sharing.
• new Function() constructor + multiple innerHTML sinks with no CSP: DOM-XSS attack surface in WhatsApp context.
• Free-webmail developer (gmail), no verified publisher, tiny install base (12) with high-tier permissions.
• External JS loaded from notiflix.github.io and reactjs.org referenced in manifest surface; no CSP to restrict.

Evidence

• cookies+whatsapp_host manifest cookies permission with host https://web.whatsapp.com/* enables full WhatsApp session/cookie access.
• privacy_policy_generic store Policy URL is Google account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• function_constructor crx new Function() in app.js allows dynamic code execution; elevated risk with no CSP.
• dom_xss_sinks crx innerHTML assigned from variables in app.js, background.js, contentScript.js; no CSP to mitigate.
• free_webmail_dev store Developer email coderlicences@gmail.com; no verified publisher badge; no business website.
• small_install_high_perm api Only 12 installs but has high-tier permissions (cookies, tabs, declarativeNetRequest, WhatsApp host).
• no_csp manifest content_security_policy is null; no CSP hardening on MV3 extension with dynamic code patterns.
• js_external_hosts crx External hosts notiflix.github.io and reactjs.org referenced; CDN dependency risk.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Extends storage quota; minimal additional risk.
• tabs medium Can read tab URLs and titles; moderate info-disclosure risk.
• cookies high Can read/write cookies; scoped to whatsapp.com and app domain but still high-impact.
• notifications low Can display OS notifications; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; moderate risk for traffic manipulation.
• host:https://web.whatsapp.com/* high Full access to WhatsApp Web DOM and cookies; captures messages and session tokens.
• host:https://app.coderlicences.com/* medium Developer backend; data exfil risk if content is sent there.

Pillar Scores

Bookkeeping