Top Risks

• Gmail dev + no developer name + no verified publisher; high-reputation-risk anonymous author.
• Google account privacy policy used — does not scope to this extension; admits data collection and 3rd-party sharing.
• cookies permission + WhatsApp host access enables full session token extraction from WhatsApp Web.
• new Function() constructor and 3x innerHTML DOM-XSS sinks across app.js, background.js, contentScript.js with no CSP.
• External JS hosts (notiflix.github.io, reactjs.org) loaded without CSP; remote code loading risk elevated by no content_security_policy.

Evidence

• free_webmail_dev_no_name store Developer email vendeczap@gmail.com, developer_name empty; anonymous free-webmail author per rubric floor >= 7.5.
• privacy_policy_google_generic store Privacy policy is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true); v3.5(D) applies → +10.0.
• cookies_plus_whatsapp_host manifest cookies permission paired with https://web.whatsapp.com/* enables full WhatsApp session token read/write.
• no_csp manifest content_security_policy is null; csp_present=false amplifies DOM-XSS and remote-host risks.
• function_constructor_no_csp crx new Function() in app.js (+2.5 code quality) with no CSP; unsafe dynamic code execution.
• dom_sink_innerhtml_no_csp crx 3 innerHTML DOM-XSS sinks across app.js/background.js/contentScript.js; csp_present=false triggers FIX B (+2.0 each, applied once).
• external_js_hosts_no_csp crx js_external_hosts: notiflix.github.io, reactjs.org; no CSP allows remote script execution → network +3.0.
• small_install_high_perm store 19 installs with cookies + host_permissions (HIGH tier); install_perm_anomaly.small_install_high_perm=true → +1.5.

Permissions Breakdown

• storage low Standard local data persistence; low standalone risk.
• unlimitedStorage low Extends storage quota; low standalone risk.
• tabs medium Can read tab URLs and metadata across browser sessions.
• cookies high Can read/write cookies; combined with WhatsApp host access enables session hijack.
• notifications low Display-only; no data exfil vector alone.
• declarativeNetRequest medium Can block/redirect network requests; lower risk than webRequestBlocking but notable.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages, contacts, and session tokens.
• https://app.coderlicences.com/* medium Undisclosed third-party license server; extension communicates data here.

Pillar Scores

Bookkeeping