Top Risks

• WhatsApp impersonation: unverified dev uses gmail, brand_mention confirmed WhatsApp impersonation.
• Privacy policy not scoped to this extension and lacks data-collection/retention disclosures.
• Content script on web.whatsapp.com can read/modify all chat data with no high-permission disclosure.
• Free-webmail dev (wl.exten.08@gmail.com), numbered alias, no verified business identity.
• Install URL hijack opens web.whatsapp.com on install; DOM-XSS sink in bundled vendor JS.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; dev domain is gmail.com, not Meta/WhatsApp.
• free_webmail_numbered_alias store Developer email wl.exten.08@gmail.com is a numbered free-webmail alias with no verified business.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false, data_collection=false; generic hiperchat policy, not extension-specific.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — redirects user on install to third-party URL.
• dom_xss_sink crx innerHTML sink in vendor.DzFEYc3-.js; no CSP present, amplifying XSS risk.
• content_script_whatsapp manifest Content script matches https://web.whatsapp.com/* giving full DOM access to all WhatsApp conversations.
• external_js_hosts crx Contacts hc-stt.hiperchat.com.br, reactjs.org, web.whatsapp.com — 3 distinct external domains.
• maintenance_3_6mo store Last updated March 2026, ~6 months ago; maintenance score elevated to 1.5.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk on its own.
• storage low Standard local data persistence, minimal risk.
• tabs medium Can read tab URLs and titles; moderate information exposure.
• alarms low Scheduling only; no data-access risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify all conversation data.

Pillar Scores

Bookkeeping