Top Risks

• Content scripts injected on ALL http/https pages despite stated WhatsApp-only purpose — scope mismatch.
• Privacy policy is generic Google account policy; does not scope to this extension at all (data_collection+3rd_party_sharing admitted without extension context).
• WhatsApp brand mention without confirmed ownership — impersonation risk.
• External request to unknown AWS Lambda endpoint (no90e5i02c.execute-api.ap-south-1.amazonaws.com) with no CSP; unclear data handling.
• Two DOM-XSS innerHTML sinks with no CSP to mitigate exploitation on every page visited.

Evidence

• broad_content_script_scope manifest content_scripts_matches includes http://*/* and https://*/* despite function limited to WhatsApp/FinalBooks.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; data_collection+3rd_party_sharing true.
• brand_impersonation crx brand_mention.is_impersonation=true for WhatsApp; developer_domain empty, confirmed_owner=false.
• unknown_aws_lambda_endpoint crx js_external_hosts includes no90e5i02c.execute-api.ap-south-1.amazonaws.com — opaque backend, no CSP constraint.
• dom_xss_sinks_no_csp crx Two innerHTML-userctrl sinks in whatsappContent.js and sidepanel.js; csp_present=false amplifies risk.
• no_developer_identity store developer_name, developer_email, and title all empty; no 'Offered by' identity verifiable.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; reputation starts elevated.
• maintenance_unknown api months_since_update=null; scored 0 (benefit of doubt, no staleness signal available).

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk for a WhatsApp integration.
• storage low Local data persistence only; low standalone risk.
• content_scripts http://*/* https://*/* high Broad content script injection on all HTTP/HTTPS sites; runs JS on every page visited.

Pillar Scores

Bookkeeping