Top Risks

• WhatsApp brand impersonation by unverified free-webmail developer (wl.exten.08@gmail.com).
• Content script on whatsapp.com can read all chat messages and DOM; sensitive data exposure.
• Install-URL hijack opens web.whatsapp.com on install — minor but signals low-quality practices.
• Privacy policy hosted at opt-api.com (third-party domain) with confirmed third-party data sharing.
• DOM-XSS sink (innerHTML) in vendor bundle with no CSP — elevated XSS risk in WhatsApp Web context.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is gmail user 'sasdac', not Meta.
• free_webmail_developer store Developer email wl.exten.08@gmail.com; no verified publisher; no business website.
• content_script_sensitive_target manifest content_scripts_matches=['https://web.whatsapp.com/*']; full DOM+message access on WhatsApp.
• install_url_hijack crx install_url_hijack=true; target=https://web.whatsapp.com on extension install.
• dom_xss_sink crx innerHTML assignment in vendor.BaH-a-x7.js with no CSP present; DOM-XSS risk in WhatsApp context.
• external_js_hosts crx 5 external hosts: hc-stt.hiperchat.com.br, locize.com, reactjs.org, web.whatsapp.com, www.i18next.com.
• privacy_policy_third_party_sharing api Policy at opt-api.com confirms data_collection=true, third_party_sharing=true, retention=true.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP hardening declared.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk for a CRM tool.
• storage low Standard local data persistence, low risk.
• tabs medium Can read tab URLs/titles; moderate risk but scoped to WhatsApp Web via content_scripts.
• alarms low Scheduling alarms; no data access risk.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM. Scope-limited but high-sensitivity target.

Pillar Scores

Bookkeeping