Top Risks

• Google generic privacy policy used — does not scope data handling to this extension at all.
• Content script on web.whatsapp.com with cookies access; can read WhatsApp messages and session.
• new Function() constructor and 3x innerHTML DOM-XSS sinks found; no CSP to mitigate.
• No developer name listed; 5 installs with high-tier permissions (tail attack surface anomaly).
• External JS hosts (notiflix.github.io, reactjs.org) referenced with no CSP — remote load risk.

Evidence

• google_generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• content_script_whatsapp_cookies manifest content_scripts + cookies on web.whatsapp.com; can exfiltrate WhatsApp session and messages.
• function_constructor_code crx new Function() found in app.js — dynamic code execution risk, no CSP present.
• dom_xss_sinks crx innerHTML assignments in app.js, background.js, contentScript.js with no CSP — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but external JS hosts undermine it.
• external_js_hosts manifest js_external_hosts: notiflix.github.io, reactjs.org — 2 distinct external domains referenced.
• no_developer_name store developer_name is empty; only 5 installs with high-tier permission (cookies+tabs+declarativeNetRequest).
• install_perm_anomaly api small_install_high_perm=true: 5 installs with cookies + tabs + declarativeNetRequest flagged.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Allows large local storage; minor risk of disk exhaustion.
• tabs medium Can read tab URLs and metadata; moderate information access.
• cookies high Can read/write cookies; sensitive — scoped only to whatsapp+coderlicences hosts.
• notifications low Can push desktop notifications; low risk in isolation.
• declarativeNetRequest medium Can intercept/modify network requests via rules; moderate risk.
• https://web.whatsapp.com/* high Content script + host access on WhatsApp — can read messages and session cookies.
• https://app.coderlicences.com/* medium Third-party licensing endpoint; extension sends data there.

Pillar Scores

Bookkeeping