Top Risks

• Cookie + WhatsApp host access: can exfiltrate WhatsApp session tokens and messages.
• Privacy policy is Google's own policy — not scoped to this extension at all (+10.0 privacy).
• Three innerHTML sinks in contentScript running on WhatsApp Web — DOM-XSS risk.
• new Function() constructor in app.js enables dynamic code execution.
• Free-webmail developer (larzinho11@gmail.com) with no verified publisher status.

Evidence

• cookies + whatsapp host manifest cookies permission + https://web.whatsapp.com/* host: full session/message read capability.
• privacy policy generic store Policy URL is myaccount.google.com/privacypolicy — Google's policy, not extension-scoped.
• dom_sink_innerhtml_userctrl x3 crx innerHTML sinks in app.js, background.js, contentScript.js with no CSP to mitigate XSS.
• function_constructor crx new Function() in app.js allows runtime code construction.
• no CSP manifest content_security_policy is null; no mitigation for eval or innerHTML sinks.
• free webmail dev store Developer email larzinho11@gmail.com; no verified publisher badge.
• external JS hosts crx js_external_hosts: notiflix.github.io, reactjs.org — remote CDN references in JS.
• generic google privacy policy store Privacy classification: scope_extension=false, data_collection=true, third_party_sharing=true.

Permissions Breakdown

• storage low Standard local data persistence; low risk.
• unlimitedStorage low Extends storage quota; minimal risk alone.
• tabs medium Can read tab URLs and metadata across browser session.
• cookies high Can read/write cookies; sensitive credential/session access.
• notifications low Display-only push notifications; low abuse potential.
• declarativeNetRequest medium Can modify/block network requests without read access to content.
• https://web.whatsapp.com/* high Full host access to WhatsApp Web — can read messages and session cookies.
• https://app.coderlicences.com/* medium Access to third-party licensing server; possible telemetry/licensing checks.

Pillar Scores

Bookkeeping