Top Risks

• WhatsApp brand impersonation by gmail-registered developer with no verified business identity.
• Free-webmail dev email (gmail) and no developer name raises accountability concerns.
• Uninstall URL hijack and install URL hijack flags present — onInstalled opens WhatsApp Web.
• Content script on WhatsApp Web reads live chat data; exfiltrated via api.wapes.lat.
• innerHTML DOM sink in content script could enable XSS if upstream WhatsApp data is attacker-controlled.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, not Meta.
• free_webmail_dev store Developer email wapes.crm@gmail.com; no developer name provided; no verified business domain.
• install_url_hijack crx install_url_hijack=true; target=https://web.whatsapp.com/ on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; target=null. Hijack flag present regardless.
• verified_publisher store verified_publisher=true; provides -3.0 reputation credit but brand impersonation overrides partially.
• dom_xss_sink crx innerHTML user-controlled assignment in content.ts; CSP present reduces amplification risk.
• amplitude_telemetry crx api2.amplitude.com in host_permissions and js_external_hosts; known analytics, telemetry-tier.
• privacy_policy_adequate api Policy fetched; scope_extension=true, data_collection=true, retention=true, third_party_sharing=true.

Permissions Breakdown

• storage low Stores local extension data; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; matches stated CRM function.
• https://api.wapes.lat/* medium Dev-controlled API endpoint; data exfil risk if compromised.
• https://api2.amplitude.com/* low Known analytics provider; telemetry-tier risk only.

Pillar Scores

Bookkeeping