Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• Uninstall and install URL hijacks detected; install redirects to web.whatsapp.com (potential tracking).
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no CSP — broad exfil surface on WhatsApp sessions.
• function_constructor (new Function) found with no CSP; DOM-XSS innerHTML sink present; code executes inside WhatsApp Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not confirmed owner.
• generic_privacy_policy crx Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints; no CSP; MV3 but no content_security_policy set.
• function_constructor crx new Function() in JS with no CSP; enables dynamic code execution inside WhatsApp Web content script.
• dom_xss_sink crx innerHTML from variable in content script on WhatsApp Web; no CSP → elevated DOM-XSS risk (FIX B applies).
• reputation_weak_dev store Developer name 'wty'; not verified publisher; not featured; email on extensao.store throwaway-pattern domain.
• webstore_install_count_anomaly store Only 49 installs; uninstall+install hijacks signal traffic-monetization intent despite small user base.

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct harm potential.
• storage low Standard local data persistence.
• alarms low Scheduling; minimal risk alone.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; enables content script injection into chat sessions.

Pillar Scores

Bookkeeping