Top Risks

• Free-webmail dev (gmail) with opaque identity 'ext.user003'; no verified publisher or business domain.
• WhatsApp brand impersonation: brand_mention.is_impersonation=true, developer has no confirmed ownership.
• Content script on web.whatsapp.com can read all WhatsApp Web DOM including messages.
• install_url_hijack opens web.whatsapp.com on install — minor but anomalous redirect signal.
• innerHTML DOM-XSS sink in vendor bundle; no CSP on MV3 extension to mitigate.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; dev is gmail user with no confirmed ownership.
• free_webmail_dev store Developer email pietrogabrielg20@gmail.com; dev name 'ext.user003'; no business website.
• install_url_hijack manifest install_url_hijack=true; target=https://web.whatsapp.com on extension install.
• content_script_sensitive_origin manifest Content script injected into https://web.whatsapp.com/*; can access full WhatsApp Web DOM.
• dom_xss_sink crx innerHTML assignment in vendor.D42Me2hF.js; no CSP present to restrict exploitation.
• privacy_policy_adequate api privacy.opt-api.com policy: fetched=true, scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.
• external_js_hosts crx External hosts: hc-stt.hiperchat.com.br (BR), reactjs.org (US), web.whatsapp.com; 2 countries.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; no governance signals present.

Permissions Breakdown

• storage low Standard extension storage; minimal risk on its own.
• unlimitedStorage low Allows storing large data locally; low direct risk but enables data hoarding.
• tabs medium Can read tab URLs and titles; medium risk for URL-based user profiling.
• alarms low Scheduling only; negligible standalone risk.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM on that origin.

Pillar Scores

Bookkeeping