Top Risks

• Critical CVE (CVE-2021-23358) in bundled underscore@1.8.3 enables arbitrary code execution; no CSP amplifies risk.
• Content script declared for <all_urls> — far exceeds stated WhatsApp-only purpose; scope mismatch +1.0.
• Privacy policy is Google's generic account policy (scope_extension=false, admits data collection + 3rd-party sharing) — +10.0 privacy pillar.
• Brand impersonation of WhatsApp by unverified free-webmail developer (shuttershanti708@gmail.com) with no developer name.
• Uninstall URL hijack confirmed; 12 external JS hosts including cdn2.waplus.io and third-party domains beyond dev control.

Evidence

• critical_cve_underscore crx underscore@1.8.3 has CVE-2021-23358 (critical, arbitrary code execution); fixed in 1.12.1. No CSP present.
• content_scripts_all_urls manifest content_scripts_matches includes <all_urls> — extension injects into every site despite WhatsApp-only stated purpose.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer is unverified free-webmail gmail account, no developer name.
• generic_google_privacy_policy store Privacy policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true — extension overrides uninstall redirect to third-party URL.
• function_constructor_new_Function crx new Function() constructor found in js/background.js and pay/js/element-ui_2.15.14.js — dynamic code execution risk.
• 12_external_js_hosts crx 12 distinct external hosts including cdn2.waplus.io, waselfsender.com, wawebsender.com, sheetjs.com beyond dev-owned domains.
• no_csp_mv3 manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening for CVE-bearing DOM-manipulation libs.

CVE Exposures (2)

Permissions Breakdown

• activeTab low Access to current tab on user action only; limited scope.
• storage low Local data persistence; low standalone risk.
• unlimitedStorage low Removes storage quota; could store large harvested data sets.
• scripting medium Programmatic script injection; high-impact when paired with broad host access.
• *://*.whatsapp.com/* (host) high Full access to WhatsApp Web: can read/send messages, harvest contacts.
• <all_urls> (content_scripts) high Content script declared for ALL URLs — far broader than stated WhatsApp purpose.

Pillar Scores

Bookkeeping