Top Risks

• WhatsApp brand impersonation by unverified gmail developer with no dev name listed.
• Broad host_permissions https://*/* + content_scripts on <all_urls> gives full DOM access to every site.
• No CSP present (MV3 default) combined with 3× innerHTML DOM-XSS sinks across bundle files.
• Privacy policy admits data collection and third-party sharing but lacks retention disclosure.
• Low install count (354) with high-tier permissions flags tail-attack-surface anomaly.

Evidence

• brand_impersonation store Title uses WhatsApp™ trademark; developer is gmail.com address with confirmed_owner=false.
• broad_host_permissions manifest host_permissions=[https://*/*] + content_scripts on <all_urls> — full site reach.
• dom_xss_sinks crx 3 innerHTML user-controlled sinks across FloatingProgressButton, SenderProcessModel, popup JS files.
• no_csp manifest csp_present=false; MV3 default applies but DOM-XSS sinks are unmitigated by policy.
• privacy_policy_third_party_sharing api Policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=false.
• developer_identity store developer_name empty, free-webmail gmail.com address, no verified business domain.
• small_install_high_perm api install_perm_anomaly: 354 installs with has_high_tier_permission=true; tail-attack signal.
• external_api_host crx js_external_hosts includes api.ext-api.com; extension calls external API endpoint.

Permissions Breakdown

• storage low Local key-value storage; low standalone risk.
• identity medium OAuth token access; can link browser identity to extension.
• identity.email medium Reads user's Google account email; PII exposure risk.
• https://*/* high Broad host permission covers all HTTPS sites; high reach.
• content_scripts:<all_urls> high Content script injected on all URLs; full DOM read/write on every page.

Pillar Scores

Bookkeeping