Top Risks

• WhatsApp impersonation by unverified gmail dev with cookies access to web.whatsapp.com session data.
• Privacy policy is Google's generic account policy — not scoped to this extension at all; scores 10.0.
• function_constructor + multiple innerHTML DOM-XSS sinks across content_script and background, no CSP.
• External JS hosts (notiflix.github.io, reactjs.org) referenced with no CSP to constrain loading.
• Free-webmail developer with no verified identity; cookies + WhatsApp host access = credential theft risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user, not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_high_risk manifest cookies permission + host https://web.whatsapp.com/* enables full session token read/write.
• function_constructor crx new Function() in app.js — dynamic code execution capability.
• dom_xss_sinks crx innerHTML user-controlled in app.js, background.js, contentScript.js; no CSP present.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — referenced without CSP constraint.
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher badge; no business domain.
• no_csp manifest content_security_policy=null on MV3 extension with innerHTML sinks and external JS hosts.

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Allows large local storage; no direct exfil risk.
• tabs medium Can read tab URLs and metadata across browser session.
• cookies high Can read/write cookies including WhatsApp session cookies; high credential risk.
• notifications low Sends desktop notifications; limited risk.
• declarativeNetRequest medium Can block/redirect network requests; scoped but capable of interference.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages, contacts, session tokens.
• https://app.coderlicences.com/* medium Dev-owned backend; data can be sent here; unverified developer.

Pillar Scores

Bookkeeping