Top Risks

• Brand impersonation: WhatsApp brand used by unverified free-webmail Gmail developer with no confirmed ownership.
• Privacy policy URL is unreachable (fetch_error) — treated as no valid policy, score 10.
• Free-webmail developer (Gmail) with no developer name and no verified publisher status.
• function_constructor (new Function()) detected in bundled JS — dynamic code execution risk.
• DOM-XSS sink (innerHTML) present and no CSP defined, amplifying XSS exposure.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain is gmail.com, confirmed_owner=false.
• privacy_policy_unreachable api privacy_policy_classification.fetched=false (HTTPError); policy URL listed but inaccessible — scored as no policy.
• free_webmail_developer store developer_email=mkt.robenilson@gmail.com, developer_name empty, no verified publisher, no featured badge.
• function_constructor crx new Function() constructor found in vmsender_193.js — dynamic code execution capability.
• dom_sink_innerhtml_no_csp crx innerHTML assignment in vmsender_12.js with csp_present=false amplifies DOM-XSS risk.
• generativelanguage_googleapis crx External host generativelanguage.googleapis.com referenced — AI/Gemini API calls possible.
• no_developer_name store developer_name is empty string; no 'Offered by' identity for accountability.
• csp_absent_mv3 manifest content_security_policy=null; MV3 has strict default but no explicit CSP hardens against code injection.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low risk alone.
• storage low Standard local storage for extension state.
• alarms low Scheduling alarms; low standalone risk.
• tabs medium Can read tab URLs and titles across browser; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web only; matches stated function.

Pillar Scores

Bookkeeping