Top Risks

• Privacy policy fetched but scope_extension=false and data_collection=false — generic policy not scoped to this extension, scored max.
• WhatsApp brand impersonation: dev (gmail, unverified) mentions 'whatsapp' — not a Meta/WhatsApp property.
• Free-webmail dev email (gmail) with no verified business; floor reputation at 7.5.
• Content script on whatsapp.com can read/modify all WhatsApp Web messages and DOM; innerHTML XSS sink present.
• Install redirect on install to web.whatsapp.com (minor hijack signal); only 12 installs with unverifiable developer.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user 'sasdac', not Meta.
• free_webmail_dev store Developer email wl.exten.08@gmail.com — free webmail, no business website verified.
• privacy_policy_generic api Policy fetched but scope_extension=false, data_collection=false — generic site policy, not extension-scoped.
• dom_xss_sink crx innerHTML assigned from variable in vendor.DzFEYc3-.js; no CSP present to mitigate DOM-XSS.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — minor hijack but confirms WhatsApp branding dependency.
• content_script_whatsapp manifest Content script injected on https://web.whatsapp.com/* — full DOM access to user messages.
• no_csp manifest content_security_policy is null; MV3 has strict default but no explicit CSP declared.
• low_install_count store Only 12 installs; unverified developer, WhatsApp impersonation claim — tail-attack-surface risk.

Permissions Breakdown

• unlimitedStorage low Local storage quota increase; no cross-origin risk.
• storage low Standard local key-value storage; low sensitivity.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Scheduling API; no data-access risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web — can read/modify messages and DOM.

Pillar Scores

Bookkeeping