Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Sheep WA CRM [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• cookies + WhatsApp host access enables WhatsApp session hijacking and message exfiltration.
• Privacy policy is Google's generic policy — not scoped to this extension; data handling undisclosed.
• No CSP + function_constructor + 3× innerHTML DOM-XSS sinks across app.js, background.js, contentScript.js.
• Gmail dev email, no developer name, no verified publisher — unverifiable identity with sensitive WA access.

Evidence

• cookies+whatsapp_host manifest cookies permission + https://web.whatsapp.com/* host — can read WA session cookies and messages.
• generic_privacy_policy store Policy is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• no_csp crx content_security_policy is null; csp_present=false on MV3 extension with DOM sinks.
• function_constructor crx new Function() in app.js — dynamic code execution capability.
• dom_xss_sinks crx innerHTML user-controlled sinks in app.js, background.js, contentScript.js — DOM-XSS risk on WhatsApp page.
• unverified_gmail_dev store Developer email sheepwacrm@gmail.com, no developer name, no verified publisher badge.
• third_party_host manifest https://app.coderlicences.com/* — unknown licensing server; unknown data transmitted.
• small_install_high_perm api Only 18 installs but has_high_tier_permission=true; install_perm_anomaly.small_install_high_perm=true.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Sheep WA CRM [credential-theft] + malext.io malicious_extension_sentry; score 5.23 -> 7.73 (+2.5 cap 2.5).

Permissions Breakdown

• storage low Local data persistence; low risk alone.
• unlimitedStorage low Extends storage quota; low risk.
• tabs medium Can read tab URLs and metadata across sessions.
• cookies high Access to cookies; paired with WhatsApp host — can read session tokens.
• notifications low User-facing notifications; limited risk.
• declarativeNetRequest medium Can block/redirect network requests; moderate capability.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Unknown third-party licensing endpoint; data exfil surface.

Pillar Scores

Bookkeeping