Top Risks

• Brand impersonation: extension uses 'WhatsApp' brand name and is not owned/verified by Meta.
• Privacy policy URL points to Chrome Web Store listing page, not a real policy; third_party_sharing admitted without scope.
• Rating of 2.7 across a large install base (1M) suggests quality or trust concerns from real users.
• No developer name listed in store; identity accountability is weak.
• Stale: 15 months since last update on an extension with 1M installs and no CSP raises option-value risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; confirmed_owner=false; developer is lukaslen.com, not Meta.
• privacy_policy_url_invalid store Privacy policy URL is the extension's own CWS listing page, not a standalone policy document.
• privacy_third_party_sharing api privacy_policy_classification: scope_extension=true, data_collection=false, third_party_sharing=true, retention=false.
• low_rating store Rating 2.7 on 1M-install extension; no review red flags in structured scan but low score is notable.
• no_developer_name store developer_name is empty string; only contact@lukaslen.com available for attribution.
• stale_extension store months_since_update=15; in 6-12 month band for maintenance scoring.
• no_csp manifest content_security_policy=null; MV3 has strict default so no extra Network penalty, but dom-sink risk unmitigated.
• verified_publisher store verified_publisher=true; applies reputation discount but impersonation overrides full benefit per v3.2 rule (9).

Permissions Breakdown

• storage low Stores extension preferences locally; minimal risk.
• host_permission: https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; matches stated function as a WhatsApp privacy tool.
• content_scripts: https://web.whatsapp.com/* medium Injects scripts into WhatsApp Web; consistent with stated purpose but grants DOM access.

Pillar Scores

Bookkeeping