Top Risks

• WhatsApp brand impersonation by unverified free-webmail dev (whatsapp.web.notifier@gmail.com).
• Privacy policy is generic/unscoped (privacypolicies.com), admits data collection and 3rd-party sharing without extension-specific scope.
• Developer identity unverifiable: free Gmail account, no business domain, no verified-publisher badge.
• Extension is 21 months stale — approaching zombie territory with 200K installs.
• No CSP on MV3 extension with scripting permission against WhatsApp Web; future code changes carry elevated risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true, brands=['whatsapp'], confirmed_owner=false, dev domain=gmail.com.
• free_webmail_dev manifest Developer email whatsapp.web.notifier@gmail.com is free webmail; no business domain resolvable.
• privacy_policy_generic api Policy hosted on privacypolicies.com, scope_extension=false, data_collection=true, third_party_sharing=true.
• maintenance_stale store Last updated Sep 2024, months_since_update=21; 200K installs at elevated staleness.
• no_csp manifest content_security_policy=null on MV3 extension with scripting permission.
• webstore_installs store 200,000 installs increases blast radius of any future compromise or malicious update.
• cve_findings_empty crx No CVEs detected in bundled JS libraries.
• code_findings_clean crx No suspicious code patterns found; obfuscation_score=0.0; 1 JS file scanned.

Permissions Breakdown

• tabs medium Can read tab URLs/titles; moderate risk for a WhatsApp notifier.
• scripting medium Allows dynamic script injection; scoped to web.whatsapp.com host permission.
• https://web.whatsapp.com/* low Narrow host scope limited to WhatsApp Web; matches stated function.

Pillar Scores

Bookkeeping