Top Risks

• Google privacy policy submitted for a WhatsApp CRM extension — completely unscoped, admits data collection and third-party sharing.
• function_constructor + multiple innerHTML sinks with no CSP: DOM-XSS and code-injection surface inside WhatsApp Web.
• cookies permission + host access to web.whatsapp.com: full WhatsApp session token accessible.
• Free-webmail developer (gmail), no developer name, no verified publisher — unaccountable operator.
• External JS hosts (notiflix.github.io, reactjs.org) loaded with no CSP, allowing script integrity bypass.

Evidence

• generic_google_privacy_policy store Privacy URL is Google's own account policy — scope_extension=false, data_collection=true, third_party_sharing=true. Scores +10.
• free_webmail_no_dev_name store Developer email deepwhatscrm@gmail.com, developer_name empty. Reputation floor >=7.5 applies.
• function_constructor_code crx new Function() found in app.js — dynamic code execution, high-risk with no CSP.
• innerHTML_sinks_no_csp crx dom_sink_innerhtml_userctrl in app.js, background.js, contentScript.js; csp_present=false triggers +2.0 each.
• cookies_plus_whatsapp_host manifest cookies permission scoped to web.whatsapp.com — can read WhatsApp session cookies.
• external_js_hosts_no_csp crx js_external_hosts: notiflix.github.io, reactjs.org; no CSP = remote script load risk.
• small_install_high_perm api install_perm_anomaly.small_install_high_perm=true; 23 installs with cookies+tabs+declarativeNetRequest.
• third_party_license_server manifest host_permissions includes https://app.coderlicences.com/* — unknown third party with full request access.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Extends storage quota; minor risk.
• tabs medium Can read tab URLs and titles across open tabs.
• cookies high Can read/write cookies; scoped to declared hosts but still sensitive.
• notifications low Can push desktop notifications; limited abuse surface without broad host.
• declarativeNetRequest medium Can block/redirect network requests per rules; moderate risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session cookies.
• https://app.coderlicences.com/* medium Contacts unknown third-party licensing server; data exfil surface.

Pillar Scores

Bookkeeping