Top Risks

• WhatsApp brand impersonation by unverified gmail developer with no business domain.
• Privacy policy is Google's generic account policy — does not scope to this extension at all; admits data collection and 3rd-party sharing.
• Content script injected into WhatsApp Web can read/modify messages and DOM.
• install_url_hijack opens https://web.whatsapp.com on install — minor but indicates low-quality practices.
• innerHTML DOM-XSS sink with no CSP — potential for content injection in WhatsApp Web context.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is gmail user, not Meta/WhatsApp.
• generic_privacy_policy store Privacy policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher; no business domain.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — low-quality signal.
• dom_sink_innerhtml crx innerHTML assignment in main.tsx-PeogdDr3.js with no CSP — DOM-XSS risk in WhatsApp Web.
• content_script_whatsapp manifest Content script scoped to https://web.whatsapp.com/* — can access messages and session.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening.
• no_verified_publisher store Not verified, not featured; developer name 'coderlicences' has no traceable business identity.

Permissions Breakdown

• tabs medium Can enumerate open tabs; moderate risk on its own.
• storage low Local key-value storage; low risk.
• alarms low Scheduled callbacks; minimal risk.
• unlimitedStorage low Removes storage quota; low direct risk.
• content_scripts https://web.whatsapp.com/* medium Script injected into WhatsApp Web — can read/modify messages and DOM.

Pillar Scores

Bookkeeping