Top Risks

• Cookie access on WhatsApp Web enables session token theft from 2+ billion users' chats.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection & 3rd-party sharing.
• WhatsApp brand impersonation by unverified free-webmail developer with 2 installs — tail-attack-surface risk.
• No CSP + multiple innerHTML DOM-XSS sinks + new Function() constructor; code injection surface is high.
• External JS hosts (notiflix.github.io, reactjs.org) loaded from non-dev CDNs with no CSP integrity enforcement.

Evidence

• cookies + whatsapp host_permission manifest cookies permission paired with https://web.whatsapp.com/* enables full session token read from WhatsApp Web.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is unverified free-webmail account.
• install_perm_anomaly api Only 2 installs but high-tier permissions (cookies, tabs, declarativeNetRequest, broad host). small_install_high_perm=true.
• no_csp + dom_sink crx csp_present=false; 3 innerHTML DOM-XSS sinks across app.js, background.js, contentScript.js → +2.0 each.
• external_js_hosts crx js_external_hosts=[notiflix.github.io, reactjs.org] with no CSP; remote CDN injection risk.
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher, no business domain → Reputation elevated.
• function_constructor crx new Function('return this') in app.js; dynamic code execution capability present.

Permissions Breakdown

• storage low Standard local data storage; expected for a CRM tool.
• unlimitedStorage low Allows large local storage; low harm in isolation.
• tabs medium Can read tab URLs and metadata; moderate risk.
• cookies high Can read/write cookies; paired with host access enables session hijack risk.
• notifications low Can show desktop notifications; low standalone risk.
• declarativeNetRequest medium Can modify network requests declaratively; moderate risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages and session cookies.
• https://app.coderlicences.com/* medium Access to developer's own backend; data exfil conduit if compromised.

Pillar Scores

Bookkeeping