Top Risks

• WhatsApp brand impersonation by unverified gmail developer with no business identity.
• Privacy policy not scoped to this extension and admits no data collection details (scope_extension=false).
• Free-webmail developer (wl.exten.05@gmail.com) with numbered alias pattern, no verifiable business.
• Content script on WhatsApp Web can read and manipulate all message content in that tab.
• install_url_hijack opens web.whatsapp.com on install; combined with WhatsApp impersonation increases trust-abuse risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, confirmed_owner=false.
• free_webmail_dev store Developer email wl.exten.05@gmail.com — numbered alias, free webmail, no verified business website.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on install.
• privacy_policy_not_scoped api Policy fetched but scope_extension=false and data_collection=false; generic company policy, not extension-specific.
• dom_xss_sink crx innerHTML assignment from variable in vendor.DzFEYc3-.js; no CSP to mitigate; DOM-XSS risk.
• no_csp manifest csp_present=false on MV3 extension; DOM sink finding is unmitigated.
• whatsapp_content_script manifest Content script injected into https://web.whatsapp.com/* can access all message data.
• low_installs_unverified store Only 27 installs, no rating, no verified publisher, no featured badge.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but can cache large data.
• storage low Standard key-value storage; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• alarms low Scheduling API; low risk on its own.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages in that tab.

Pillar Scores

Bookkeeping