Top Risks

• Google's own privacy policy used — not scoped to this extension; admits data collection and 3rd-party sharing.
• Full cookie + content-script access to WhatsApp Web exposes session tokens and message data.
• No CSP declared (MV3) combined with innerHTML sinks and new Function() in contentScript raises XSS risk.
• Free-webmail dev (gmail) with no developer name and no verified publisher — low accountability.
• Small install base (364) with high-tier permissions is a tail-attack-surface signal.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• cookies+whatsapp_host manifest cookies permission paired with https://web.whatsapp.com/* enables full WhatsApp session hijack.
• no_csp manifest content_security_policy is null; no CSP on MV3 extension with DOM-XSS sinks present.
• function_constructor crx new Function() in app.js — dynamic code execution path present.
• dom_sink_innerhtml_userctrl crx innerHTML sinks in app.js, background.js, contentScript.js without CSP guard.
• free_webmail_no_devname store Developer email coderlicences@gmail.com; developer_name is empty; no verified publisher.
• install_perm_anomaly api small_install_high_perm=true: 364 installs with cookies + tabs + declarativeNetRequest.
• js_external_hosts crx CSP references notiflix.github.io and reactjs.org as external JS hosts without restriction.

Permissions Breakdown

• storage low Standard local data storage; low risk.
• unlimitedStorage low Extends storage quota; low risk on its own.
• tabs medium Can read tab URLs and titles across sessions.
• cookies high Can read/write cookies on permitted hosts including WhatsApp.
• notifications low Can display desktop notifications; low standalone risk.
• declarativeNetRequest medium Can intercept/modify network requests declaratively.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — can read messages, contacts, session cookies.
• https://app.coderlicences.com/* medium Sends data to developer backend; exfil surface for license/user data.

Pillar Scores

Bookkeeping