Top Risks

• Privacy policy is Google's generic policy — admits data collection and 3rd-party sharing without scoping to this extension.
• WhatsApp brand impersonation by unverified developer (extensao.store); no confirmed ownership.
• Uninstall URL hijack flagged; install redirect to web.whatsapp.com without user context.
• 11 external JS hosts under wascript.com.br/watools.com.br with no CSP — remote code risk.
• function_constructor (new Function()) found in content script running on WhatsApp Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not confirmed owner.
• generic_privacy_policy store Privacy URL is Google account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints contacted; no CSP to constrain them.
• function_constructor crx new Function() used in content script — dynamic code execution surface on WhatsApp Web.
• dom_xss_sink crx innerHTML assigned from variable in content script; no CSP mitigates XSS.
• no_csp manifest content_security_policy=null; MV3 default applies but external host contacts are unrestricted.
• low_installs_unverified store Only 7 installs, no verified publisher, no featured badge, no ratings — unvetted supply chain.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone.
• storage low Standard local key-value storage.
• alarms low Scheduling only; no data access.
• tabs medium Can enumerate open tabs and URLs; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all page content there.

Pillar Scores

Bookkeeping