Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com.
• WhatsApp brand impersonation by unconfirmed developer on extensao.store domain.
• 11 external JS hosts across wascript.com.br and watools.com.br; no CSP to constrain them.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in 334-file codebase without CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack manifest uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• generic_privacy_policy store Privacy policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 10+ distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; no CSP present.
• function_constructor crx new Function() constructor detected in content script JS; code execution risk.
• dom_xss_sink crx innerHTML assigned from variable; no CSP amplifies DOM-XSS risk.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit restriction on connect-src.
• low_installs_unverified_dev store Only 14 installs; not verified publisher; developer Intzp on extensao.store TLD.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard key-value storage; minimal risk alone.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host permission scoped only to WhatsApp Web; matches stated CRM function.

Pillar Scores

Bookkeeping