Top Risks

• Broad host access (http://*/* + https://*/*) with scripting permission far exceeds WhatsApp bulk-msg scope — can read/modify any page.
• Privacy policy is Google's own policy; not scoped to this extension and admits data collection + third-party sharing.
• Developer domain sendprox12.com does not resolve; API backend is unverifiable, raising exfil concern.
• WhatsApp brand impersonation by unverified developer; extension harvests WhatsApp session data.
• DOM-XSS innerHTML sink in popup JS with no CSP in place amplifies injection risk.

Evidence

• broad_host_access manifest host_permissions include http://*/* and https://*/* alongside scripting; scope-mismatch with WhatsApp tool description.
• unresolvable_developer_domain api threat_intel: sendprox12.com resolves=false; API endpoint api.sendprox12.com hosted on non-resolving domain.
• generic_google_privacy_policy store Privacy policy URL points to myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped.
• brand_impersonation store brand_mention: is_impersonation=true for WhatsApp; confirmed_owner=false; developer not verified.
• dom_xss_sink_no_csp crx innerHTML user-controlled sink in popup-B202Mpxn.js; csp_present=false amplifies XSS risk (FIX B).
• scope_mismatch_host_permissions manifest Hosts include Facebook, Instagram, LinkedIn, Pinterest, Reddit, Twitter/X — unrelated to WhatsApp messaging.
• privacy_policy_data_collection_third_party api classification: scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy pillar (v3.5-D).
• unverified_developer store verified_publisher=false, is_featured=false, developer_name=Business Enterprise (generic), email on non-resolving domain.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• sidePanel low UI surface only; no data access on its own.
• tabs medium Can enumerate open tabs including URLs; moderate info exposure.
• scripting high Programmatic script injection into pages; paired with broad host access is critical.
• activeTab medium Temporary access to current tab; lower risk but enables page reading.
• alarms low Scheduling only; no data exfil surface.
• host:https://web.whatsapp.com/* high Access to WhatsApp messages and contacts; bulk-messaging abuse vector.
• host:https://sendprov12.online/* high Unknown third-party backend; developer domain doesn't resolve — throwaway endpoint.
• host:https://api.sendprox12.com/* high Developer API; unresolvable domain raises exfil concern.
• host:https://www.google.com/* medium Access to Google session; not justified by WhatsApp bulk-messaging function.
• host:https://www.facebook.com/* medium Social platform access beyond stated WhatsApp scope.
• host:https://www.instagram.com/* medium Social platform access beyond stated WhatsApp scope.
• host:https://www.pinterest.com/* medium Social platform access beyond stated WhatsApp scope.
• host:https://www.linkedin.com/* medium Professional network access; unjustified by description.
• host:https://twitter.com/* medium Social platform access beyond stated WhatsApp scope.
• host:https://x.com/* medium Duplicate Twitter/X access; broad social reach.
• host:https://www.reddit.com/* medium Social platform access beyond stated WhatsApp scope.
• host:http://*/* high Unrestricted HTTP host access; far exceeds WhatsApp tool scope.
• host:https://*/* high Unrestricted HTTPS host access; paired with scripting = critical capability.

Pillar Scores

Bookkeeping