Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Leads Zap [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Gmail developer with no business identity; Google privacy policy is not scoped to this extension.
• cookies permission on WhatsApp Web enables session token exfiltration from messaging platform.
• No CSP + function_constructor + 3 innerHTML DOM-XSS sinks across app.js, background.js, contentScript.js.
• External JS hosts (notiflix.github.io, reactjs.org) loaded without CSP; supply-chain risk.

Evidence

• free_webmail_dev_no_business store Developer email lidiacotacoes@gmail.com; no developer name; no business website.
• generic_google_privacy_policy store Privacy policy points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_on_whatsapp manifest cookies permission scoped to web.whatsapp.com; can read WhatsApp session cookies.
• no_csp_with_code_risks crx csp_present=false; function_constructor and 3 innerHTML sinks present; XSS risk elevated.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — loaded without CSP restriction.
• small_install_high_perm api 24 installs with high-tier permissions (cookies, tabs, declarativeNetRequest) — tail anomaly.
• third_party_licensing_host manifest host_permissions includes app.coderlicences.com; unknown third-party backend with full access.
• no_developer_name store developer_name is empty string; no verified publisher badge; no featured badge.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Leads Zap [data-theft] + malext.io malicious_extension_sentry; score 5.09 -> 7.59 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard key-value storage; low risk alone.
• unlimitedStorage low Allows large local data; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk.
• cookies high Can read/write cookies; scoped to WhatsApp host but still high-risk API.
• notifications low Push notifications; low risk without broad host access.
• declarativeNetRequest medium Can block/redirect network requests declaratively.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and contacts.
• https://app.coderlicences.com/* medium Access to third-party licensing server; potential exfil vector.

Pillar Scores

Bookkeeping