Top Risks

• Free-webmail developer (gmail) with no verified business identity — elevated supply-chain risk.
• WhatsApp brand impersonation: unverified dev uses WhatsApp branding without confirmed ownership.
• Content script on web.whatsapp.com can access messages and contacts without broad host perms.
• install_url_hijack opens web.whatsapp.com on install — low-severity redirect signal.
• DOM-XSS sink (innerHTML) present in vendor bundle and no CSP to mitigate it.

Evidence

• free_webmail_developer store Developer email wl.exten.09@gmail.com — free webmail, no verified business domain.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain is gmail.com, confirmed_owner=false.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com on extension install.
• content_script_sensitive_origin manifest Content script injected into https://web.whatsapp.com/* — can read WhatsApp messages/contacts.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• dom_xss_sink crx innerHTML user-controlled assignment in vendor.DzFEYc3-.js; no CSP present, raising XSS risk.
• privacy_policy_shared_platform store Privacy policy at privacy.opt-api.com — third-party policy platform; scope_extension=true but not dev-owned domain.
• low_install_count store Only 11 installs; very low adoption makes reputation signals weak and trust low.

Permissions Breakdown

• unlimitedStorage low Local data storage only; no network exfil by itself.
• storage low Standard key-value local storage, minimal risk.
• tabs medium Can read tab URLs and titles; moderate info-disclosure risk.
• alarms low Scheduling only; no direct data access.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and contacts in that context.

Pillar Scores

Bookkeeping