Top Risks

• WhatsApp Web host permission + cookies = full access to messages, contacts, and session tokens.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• No CSP; innerHTML sinks in content script, background, and app.js create DOM-XSS risk on WhatsApp page.
• Free-webmail developer (gmail), brand impersonation of WhatsApp with unverified ownership.
• new Function() constructor in app.js allows dynamic code execution; no CSP to mitigate.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain is gmail.com, not Meta/WhatsApp.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 rule D).
• cookies_high_perm manifest cookies permission combined with https://web.whatsapp.com/* enables session token exfiltration.
• no_csp crx csp_present=false on MV3 extension; innerHTML sinks in 3 files amplify XSS risk.
• function_constructor crx new Function() in app.js enables dynamic code execution; scores +2.5 code quality.
• dom_sink_innerhtml_x3 crx innerHTML sinks in app.js, background.js, contentScript.js; no CSP → elevated to +2.0 each (FIX B).
• free_webmail_dev store coderlicences@gmail.com; no verified publisher, no featured badge, no business domain.
• small_install_high_perm api install_perm_anomaly: 6 installs with high-tier permissions (cookies, tabs, declarativeNetRequest).

Permissions Breakdown

• storage low Stores local CRM data; low risk in isolation.
• unlimitedStorage low Expands storage quota; minor risk.
• tabs medium Can read tab URLs and metadata across sessions.
• cookies high Can read/write cookies; scoped to WhatsApp and app domain but still sensitive.
• notifications low Push notifications only; low capability risk.
• declarativeNetRequest medium Can modify/block network requests declaratively.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — messages, contacts, sessions.
• https://app.coderlicences.com/* medium Backend API contact; data may be exfiltrated to dev server.

Pillar Scores

Bookkeeping