Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — fbsender [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Content scripts injected on ALL http/https pages despite stated WhatsApp-only purpose — scope mismatch.
• Privacy policy is generic Google account policy; does not scope to this extension at all (data_collection+3rd_party_sharing admitted without extension context).
• WhatsApp brand mention without confirmed ownership — impersonation risk.
• External request to unknown AWS Lambda endpoint (no90e5i02c.execute-api.ap-south-1.amazonaws.com) with no CSP; unclear data handling.

Evidence

• broad_content_script_scope manifest content_scripts_matches includes http://*/* and https://*/* despite function limited to WhatsApp/FinalBooks.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+3rd_party_sharing true.
• brand_impersonation crx brand_mention.is_impersonation=true for WhatsApp; developer_domain empty, confirmed_owner=false.
• unknown_aws_lambda_endpoint crx js_external_hosts includes no90e5i02c.execute-api.ap-south-1.amazonaws.com — opaque backend, no CSP constraint.
• dom_xss_sinks_no_csp crx Two innerHTML-userctrl sinks in whatsappContent.js and sidepanel.js; csp_present=false amplifies risk.
• no_developer_identity store developer_name, developer_email, and title all empty; no 'Offered by' identity verifiable.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts elevated.
• maintenance_unknown api months_since_update=null; scored 0 (benefit of doubt, no staleness signal available).
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — fbsender [data-theft] + malext.io malicious_extension_sentry; score 5.08 -> 7.58 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk for a WhatsApp integration.
• storage low Local data persistence only; low standalone risk.
• content_scripts http://*/* https://*/* high Broad content script injection on all HTTP/HTTPS sites; runs JS on every page visited.

Pillar Scores

Bookkeeping