Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — BC ZAP [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail developer (gmail) with no verified business identity — high impersonation/abandonment risk.
• WhatsApp brand impersonation: confirmed_owner=false, developer uses gmail, not Meta.
• Content script on web.whatsapp.com can read all chat DOM including message content.
• Privacy policy not scoped to this extension and does not specify data collection; third-party sharing silence adds uncertainty.

Evidence

• free_webmail_dev store Developer email wl.exten.02@gmail.com is a numbered-alias Gmail; no verified business.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, confirmed_owner=false.
• content_script_sensitive_domain manifest Content script injected into https://web.whatsapp.com/* — reads full WhatsApp Web DOM.
• privacy_policy_not_scoped api Privacy policy fetched but scope_extension=false, data_collection=false; generic company policy, not extension-specific.
• install_url_hijack crx install_url_hijack=true; opens https://web.whatsapp.com on install.
• dom_xss_sink crx innerHTML assigned from variable in vendor bundle; no CSP present (MV3 default only).
• no_csp_explicit manifest csp_present=false; MV3 provides default but no explicit extension CSP declared.
• very_low_installs store Only 6 installs; unproven extension with sensitive WhatsApp access and unverified developer.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — BC ZAP [data-theft] + malext.io malicious_extension_sentry; score 4.36 -> 6.86 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; no direct data exfil risk alone.
• storage low Standard local key-value storage; low risk.
• tabs medium Can read tab URLs/titles; moderate metadata exposure.
• alarms low Scheduling only; no data access.
• content_scripts:https://web.whatsapp.com/* medium Runs JS in WhatsApp Web context; can read chat content and DOM.

Pillar Scores

Bookkeeping