Top Risks

• Brand impersonation: extension name combines 'Claude' (Anthropic) and 'WhatsApp' (Meta); dev is unverified gmail account.
• Cookies permission on web.whatsapp.com enables theft of WhatsApp session tokens and message data.
• Privacy policy is Google's own generic policy — does not scope to this extension at all; scores 10.0.
• function_constructor + multiple innerHTML sinks with no CSP — DOM-XSS and arbitrary code execution risk.
• Small install count (11) with high-tier permissions is a tail-attack-surface signal; extension may be staging for wider abuse.

Evidence

• brand_impersonation store Extension title combines 'Claude' and 'WhatsApp' brands; developer is unverified gmail user, confirmed_owner=false.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• cookies_high_value_host manifest cookies permission + host_permission on web.whatsapp.com enables session token exfiltration.
• function_constructor crx new Function() constructor in app.js — dynamic code execution path without CSP guard.
• dom_xss_sinks crx innerHTML assignments in app.js, background.js, contentScript.js with no CSP; elevated XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applied, but code findings elevate risk without explicit CSP).
• small_install_high_perm api Only 11 installs with cookies + tabs + declarativeNetRequest on WhatsApp — tail attack surface anomaly.
• free_webmail_developer store Developer email coderlicences@gmail.com; no verified publisher badge; no business domain.

Permissions Breakdown

• storage low Standard local data persistence, low risk.
• unlimitedStorage low Allows large local storage; no direct exfil risk.
• tabs medium Can read tab URLs and metadata, moderate privacy risk.
• cookies high Can read/write cookies on declared host_permissions, including WhatsApp session cookies.
• notifications low Can push desktop notifications; low standalone risk.
• declarativeNetRequest medium Can block/redirect network requests; scoped but notable capability.
• https://web.whatsapp.com/* high Full access to WhatsApp web, including messages, contacts, session data.
• https://app.coderlicences.com/* medium Communicates with developer backend; potential data exfil surface.

Pillar Scores

Bookkeeping