Top Risks

• Brand impersonation: claims WhatsApp affiliation; dev is unaffiliated gmail user with no dev name.
• Broad host_permissions (https://*/*) + content scripts on <all_urls> enable reading all HTTPS page content.
• Developer email is free webmail (gmail) with no business identity; verified_publisher status alone is insufficient.
• Privacy policy discloses third-party sharing but no data retention period; identity.email scope raises exfil risk.
• DOM-XSS sinks (innerHTML) in two JS files with no CSP — amplifies XSS risk from page-injected content.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, confirmed_owner=false.
• free_webmail_dev_no_name store developer_email=exportmyinfohq@gmail.com; developer_name empty; no verified business domain.
• broad_host_permissions manifest host_permissions=[https://*/*]; content_scripts_matches=[<all_urls>, https://*.whatsapp.com/*].
• dom_xss_sink_no_csp crx innerHTML assigned from variable in 2 JS files; csp_present=false — no mitigation against DOM-XSS.
• identity_email_permission manifest identity + identity.email declared — extension can acquire and transmit the user's Google email.
• amazon_js_host crx js_external_hosts includes www.amazon.com — unexpected for a translation/voice tool; warrants review.
• privacy_policy_no_retention api Policy scoped to extension and acknowledges data collection + third-party sharing but lacks retention period.
• small_install_high_perm store install_perm_anomaly.small_install_high_perm=true; 396 installs with HIGH-tier host permissions.

Permissions Breakdown

• storage low Stores local extension state; limited blast radius.
• identity medium OAuth token acquisition; can identify user account.
• identity.email medium Explicitly reads user Google email address.
• https://*/* high Broad host permission — content scripts can read/modify all HTTPS pages.
• <all_urls> (content_scripts) high Content scripts injected into all URLs, enabling broad page-data access.

Pillar Scores

Bookkeeping