Top Risks

• cookies permission + WhatsApp host access enables WhatsApp session-cookie theft.
• Privacy policy is a generic Google account URL that failed to load — no extension-scoped disclosure.
• No CSP declared; new Function() constructor and 3 innerHTML sinks elevate XSS risk.
• External JS hosts (notiflix.github.io, reactjs.org) referenced — remote CDN dependency without CSP.
• Small install base (53) with high-tier permissions (cookies, tabs, host) is a tail-attack-surface signal.

Evidence

• cookies + whatsapp host access manifest cookies permission scoped to web.whatsapp.com — full session token access to WhatsApp Web.
• privacy policy unfetchable / generic store URL points to Google account policy; fetch returned SSLError; no extension-specific scope.
• no CSP declared (MV3) manifest content_security_policy is null; csp_present=false. Compounds innerHTML and Function() risk.
• function_constructor in app.js crx new Function('return this') in app.js — dynamic code execution sink.
• dom_sink_innerhtml x3 files crx innerHTML assigned from variable in app.js, background.js, contentScript.js — DOM-XSS sinks.
• external JS hosts without CSP manifest notiflix.github.io and reactjs.org listed in js_external_hosts; no CSP pins them.
• install_perm_anomaly api 53 installs with high-tier permissions (cookies, tabs, host) flagged as small_install_high_perm.
• unverified publisher / no featured badge store verified_publisher=false, is_featured_by_google=false; developer domain resolves but unverified.

Permissions Breakdown

• storage low Standard key-value store; limited standalone risk.
• unlimitedStorage low Allows large local data; no direct exfil risk alone.
• tabs medium Can read URLs and titles of all open tabs.
• cookies high Can read/write cookies; combined with WhatsApp host access raises session-hijack risk.
• notifications low Can push browser notifications; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; no dynamic rule injection without host access.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — messages, contacts, session cookies.
• https://app.coderlicences.com/* medium License-check endpoint; external third-party dependency for activation.

Pillar Scores

Bookkeeping