Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Dialogfy [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension; developer's data practices undisclosed.
• WhatsApp impersonation flag: confirmed_owner=false; may mislead users about affiliation with Meta/WhatsApp.
• No developer name listed; reduces accountability.
• Scripting + tabs on WhatsApp Web gives access to message content with no disclosed retention policy.

Evidence

• privacy_policy_generic store Privacy policy URL points to Google's generic account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain dialogfy.com not confirmed as Meta/WhatsApp owner.
• no_developer_name store developer_name is empty string; no 'Offered by' identity beyond email.
• scripting_on_whatsapp manifest scripting + content_scripts scoped to web.whatsapp.com — can read/manipulate WhatsApp message DOM.
• js_external_hosts crx 5 external hosts all under dialogfy.com or whatsapp.com; no bad-host hits detected.
• no_csp manifest content_security_policy is null; MV3 strict default applies, partially mitigating risk.
• low_installs store Only 37 installs; minimal community signal or vetting available.
• cve_findings_empty crx No CVEs or bad-host hits detected in cve_findings_raw.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Dialogfy [data-theft] + malext.io malicious_extension_sentry; score 2.50 -> 5.00 (+2.5 cap 2.5).

Permissions Breakdown

• alarms low Schedules periodic tasks; low standalone risk for a scheduled-message tool.
• storage low Persists local data; standard and low-risk.
• tabs medium Can read URL/title of all open tabs; moderate data-exposure risk.
• scripting medium Injects scripts into permitted hosts; scoped to WhatsApp Web only.
• https://web.whatsapp.com/* medium Grants content-script and scripting access to WhatsApp Web — message content visible.
• https://dbext.dialogfy.com/* low Scoped to dev-controlled backend; expected for syncing scheduled messages.

Pillar Scores

Bookkeeping