Top Risks

• Gmail developer with Google privacy policy link — policy does not scope to this extension at all (Privacy +10).
• cookies permission + content script on web.whatsapp.com enables WhatsApp session token and message access.
• new Function() constructor + 3x innerHTML sinks in contentScript/app/background without CSP — DOM-XSS risk.
• Free-webmail developer (coderlicences@gmail.com), no verified publisher, 24 installs — low accountability.
• install_perm_anomaly: small install count (24) with high-tier permissions is a tail-attack-surface indicator.

Evidence

• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher; no business domain.
• generic_google_privacy_policy store Privacy URL is Google account policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_on_whatsapp manifest cookies permission + content_scripts targeting web.whatsapp.com — full session/message access possible.
• function_constructor_code crx new Function() in app.js — dynamic code execution risk without CSP guard.
• dom_xss_sinks crx innerHTML sinks in app.js, background.js, contentScript.js; csp_present=false amplifies risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening declared.
• small_install_high_perm api install_perm_anomaly: 24 installs with high-tier permissions (cookies, tabs, declarativeNetRequest).
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — external CDN references present.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Allows large local storage; minor resource concern only.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com host perms.
• notifications low Can display desktop notifications; no data access.
• declarativeNetRequest medium Can block/redirect network requests per rules; no direct traffic interception.
• https://web.whatsapp.com/* high Content script + cookies access on WhatsApp; can read messages and session tokens.
• https://app.coderlicences.com/* medium Dev-controlled backend; data likely sent here but domain unverified.

Pillar Scores

Bookkeeping