Top Risks

• Brand impersonation: 'Whatsapp GB' mimics WhatsApp trademark from unverified gmail developer with no confirmed ownership.
• Privacy policy is Google's own generic policy — scope_extension=false, data_collection=true, third_party_sharing=true — worst-case privacy disclosure.
• Cookies permission + host access to web.whatsapp.com enables full session-cookie exfiltration of WhatsApp Web accounts.
• function_constructor + multiple innerHTML DOM-XSS sinks without CSP raise code-execution risk inside WhatsApp Web context.
• Small-install + high-permission anomaly (249 installs) with unverified gmail developer and no business domain — tail attack surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['whatsapp']; confirmed_owner=false; dev is gmail account.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false; data_collection=true; third_party_sharing=true.
• cookies_permission_whatsapp_host manifest cookies + host perm on web.whatsapp.com/* enables full session-token access.
• function_constructor_code crx new Function() in app.js — dynamic code execution path without CSP guard.
• dom_xss_sinks_no_csp crx 3 innerHTML sinks across app.js/background.js/contentScript.js; csp_present=false.
• external_js_hosts crx js_external_hosts: notiflix.github.io, reactjs.org — remote CDN references with no CSP integrity.
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher; no business domain resolved.
• install_perm_anomaly api small_install_high_perm=true; 249 installs with cookies+tabs+declarativeNetRequest+WhatsApp host access.

Permissions Breakdown

• storage low Local state persistence only.
• unlimitedStorage low Extended local storage; no remote exfil by itself.
• tabs medium Can read tab URLs and titles across sessions.
• cookies high Can read/write cookies; scoped to whatsapp.com and coderlicences.com host perms.
• notifications low Desktop notifications; limited standalone risk.
• declarativeNetRequest medium Can rewrite/block network requests within declared rules.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — can read messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Developer-controlled backend; unverified third-party data endpoint.

Pillar Scores

Bookkeeping