Multi Chat - Messenger for WhatsAppSecurity Analysis

Creates functions from strings, similar to eval(), often used to hide malicious code.

Dynamically creates script elements, potentially loading external malicious code.

Creates a function from a string (new Function()), similar to eval().

Content script runs at document_start in ALL frames on ALL URLs. This gives the extension deep access to every page load, including iframes.

Extension tracks open tabs and communicates with external servers — potential browsing surveillance.

Decodes base64 data, commonly used to hide malicious payloads.

Sends messages via Chrome runtime, could communicate with external services.

Line exceeds 5000 characters (entropy: 5.325790932977823)

This extension does not define a Content Security Policy. A CSP helps prevent XSS and code injection attacks.

Web-accessible resources use <all_urls> or wildcard patterns, exposing resources to every website.

Sets innerHTML directly, which can lead to XSS if used with untrusted data.

js/jquery.min.js