Top Risks

• Gmail developer account with no developer name — unverifiable identity for extension touching WhatsApp Web session.
• Privacy policy is Google's own policy (scope_extension=false, admits data collection & 3rd-party sharing) — worst-case privacy score.
• cookies permission + content script on WhatsApp Web enables harvesting of session tokens and message data.
• No CSP + multiple innerHTML sinks across app.js, background.js, contentScript.js elevates DOM-XSS risk.
• External JS hosts (notiflix.github.io, reactjs.org) loaded without CSP — remote code execution surface.

Evidence

• free_webmail_developer_no_name store Developer email gabrielceojlle@gmail.com, no developer name provided — unverifiable identity.
• privacy_policy_generic_google store Privacy URL points to Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• cookies_whatsapp_host manifest cookies permission + host access to web.whatsapp.com/* enables session token and message exfiltration.
• no_csp_mv3 manifest content_security_policy is null; csp_present=false. MV3 has defaults but no explicit CSP declared.
• dom_xss_sinks_no_csp crx innerHTML sinks in app.js, background.js, contentScript.js with csp_present=false raises XSS risk.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — external script surface without CSP guard.
• small_install_high_perm api Only 111 installs but has high-tier permissions (cookies, tabs, host access to WhatsApp Web).
• function_constructor crx new Function() constructor found in app.js — dynamic code execution risk.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Allows large local storage quota; minimal risk alone.
• tabs medium Can read tab URLs and metadata; moderate risk.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com host perms.
• notifications low Can display desktop notifications; low abuse potential.
• declarativeNetRequest medium Can intercept/block network requests; no redirect capability in declarative mode.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Access to developer-controlled licensing endpoint; limited but opaque.

Pillar Scores

Bookkeeping