Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WhatsMais Web Plugin [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• cookies permission + WhatsApp host access enables full WhatsApp session token exfiltration.
• Google privacy policy used as proxy; does not scope data handling to this extension.
• Free-webmail developer (Gmail) with no developer name — zero accountability.
• function_constructor + innerHTML sinks with no CSP create DOM-XSS and code-injection surface.

Evidence

• cookies + whatsapp host manifest cookies permission scoped to web.whatsapp.com/* allows reading WhatsApp session cookies.
• generic google privacy policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free-webmail dev, no name store Developer email whatsmaiswebplugin@gmail.com, developer_name empty — no verifiable identity.
• function_constructor in app.js crx new Function() constructor found in app.js — dynamic code execution risk.
• dom_sink_innerhtml_userctrl x3 crx innerHTML sinks in app.js, background.js, contentScript.js with no CSP — DOM-XSS risk.
• no CSP + external JS hosts manifest csp_present=false; js_external_hosts include notiflix.github.io and reactjs.org.
• small install + high perm api Only 14 installs but cookies + tabs + host perms flagged by install_perm_anomaly.
• unknown third-party backend manifest host_permission app.coderlicences.com is an unverified licensing server with no transparency.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WhatsMais Web Plugin [data-theft] + malext.io malicious_extension_sentry; score 5.48 -> 7.98 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Standard local data persistence; low risk alone.
• unlimitedStorage low Allows large local storage; minor risk.
• tabs medium Can read tab URLs and metadata; moderate privacy impact.
• cookies high Can read/write cookies; combined with host permissions enables session hijack.
• notifications low Can push notifications; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; scope limited to declared rules.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session cookies.
• https://app.coderlicences.com/* medium Access to unknown third-party licensing backend; data exfil surface.

Pillar Scores

Bookkeeping