Top Risks

• Free-webmail Gmail dev with generic username; no verified business identity — elevated impersonation/abandonment risk.
• Brand impersonation: extension targets WhatsApp Web but developer is unaffiliated with Meta/WhatsApp.
• Content script on web.whatsapp.com can read/modify all WhatsApp Web messages and UI with no broad host fallback.
• install_url_hijack opens web.whatsapp.com on install — minor but signals monetization/tracking intent.
• innerHTML DOM-XSS sink in vendor bundle with no CSP; MV3 mitigates but sink remains exploitable.

Evidence

• free_webmail_dev store Developer email pietrogabrielg20@gmail.com is free webmail; developer_name 'ext.user003' is generic alias.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is not a confirmed Meta/WhatsApp owner.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on install.
• content_script_sensitive_domain manifest content_scripts injected into https://web.whatsapp.com/* — full page read/write on messaging platform.
• dom_xss_sink crx innerHTML assigned from variable in vendor.BaH-a-x7.js; no CSP present to mitigate.
• no_csp manifest csp_present=false; MV3 default applies but no explicit script-src hardening.
• privacy_policy_adequate api Privacy policy at privacy.opt-api.com: fetched, scoped, data_collection+retention+3rd-party all disclosed.
• low_installs store Only 21 installs; tail extension with no community trust signals.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm potential.
• storage low Basic key-value local storage; standard for extensions.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Schedules background tasks; minimal direct risk.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages and page content.

Pillar Scores

Bookkeeping