Top Risks

• cookies + WhatsApp host access exposes full session tokens and messages to a gmail-dev backend.
• Privacy policy is Google's generic policy — does not scope to this extension; classified as non-compliant.
• new Function() constructor + 3x innerHTML sinks with no CSP create DOM-XSS / code-injection surface.
• External JS hosts (notiflix.github.io, reactjs.org) loaded without CSP — remote code injection vector.
• Free-webmail developer with no verified publisher status and small install base; tail attack surface flagged.

Evidence

• cookies + whatsapp host manifest cookies permission + host_permission https://web.whatsapp.com/* allows full WhatsApp session cookie access.
• generic privacy policy api Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• no CSP + external JS hosts crx csp_present=false; js_external_hosts=[notiflix.github.io, reactjs.org]; remote scripts can be loaded.
• function_constructor in app.js crx new Function() detected — dynamic code execution risk per code_findings_raw.
• dom_sink_innerhtml x3 crx innerHTML sinks in app.js, background.js, contentScript.js; no CSP amplifies DOM-XSS risk.
• free-webmail developer store Developer email coderlicences@gmail.com; no verified publisher; domain_age_ct not queryable.
• small_install_high_perm api 408 installs with high-tier permissions (cookies, tabs, declarativeNetRequest); tail attack surface.
• operator cluster api sibling_count=0; fingerprint ties to gmail dev + external CDN hosts; no cluster amplification.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Allows large local storage; minor abuse potential.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• cookies high Access to cookies scoped to host_permissions; can read WhatsApp session cookies.
• notifications low Sends desktop notifications; low risk.
• declarativeNetRequest medium Can block/redirect network requests; moderate capability.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including session data, messages, contacts.
• https://app.coderlicences.com/* medium Dev-controlled backend; data could be sent here.

Pillar Scores

Bookkeeping