Top Risks

• Operator cluster of 8 extensions under same dev email/fingerprint — coordinated install farm or repackaging ring.
• Uninstall URL hijack confirmed; install redirect to WhatsApp Web signals session/cookie harvesting setup.
• Privacy policy is Google's own policy — not scoped to this extension; ADMITS data collection and 3rd-party sharing.
• 10 distinct wascript.com.br / watools.com.br external hosts contacted; large exfil surface from WhatsApp chat data.
• WhatsApp brand impersonation by unverified publisher with only 11 installs — tail-attack-surface risk.

Evidence

• operator_cluster_siblings api 7 sibling extensions share same dev email, install URL, and external host fingerprint — cluster of 8 total.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install also redirects to web.whatsapp.com.
• generic_privacy_policy store Privacy URL points to Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not confirmed WhatsApp owner.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts — broad outbound surface on chat data.
• function_constructor crx new Function() constructor found in bundled JS — code execution from string risk.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS risk.
• no_csp crx content_security_policy is null; no CSP protection amplifies DOM-XSS and Function() risks.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone.
• storage low Standard local key-value storage; low risk.
• alarms low Scheduling API; low risk standalone.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Content scripts injected into WhatsApp Web; can read all chat content.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Scoring History

Bookkeeping