Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (score +10).
• Uninstall URL hijack and install URL hijack both flagged — classic monetization/tracking pattern.
• WhatsApp brand impersonation: developer domain (extensao.store) is not Meta/WhatsApp; confirmed_owner=false.
• 10 external JS hosts under wascript.com.br / watools.com.br — broad backend surface for a 69-install CRM tool.
• function_constructor (new Function) in content script + innerHTML DOM-XSS sink with no CSP.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; uninstall_url_target=null but flag is true — monetization/tracking pattern.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — mild but combined with uninstall hijack raises concern.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not Meta; confirmed_owner=false.
• generic_privacy_policy store Privacy URL points to Google's own account policy — not scoped to WhatSeller; data_collection+3rd_party_sharing=true.
• external_js_hosts crx 10 wascript.com.br / watools.com.br endpoints contacted; large backend surface for 69-install extension.
• function_constructor crx new Function() detected in content script — dynamic code execution risk, no CSP to constrain.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit hardening declared.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard local key-value storage; low risk.
• alarms low Schedules periodic tasks; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• host_permission: https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; matches stated CRM function but grants full page access.

Pillar Scores

Bookkeeping