Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer does not own WhatsApp IP; confirmed_owner=false.
• Uninstall URL hijack flag set; install redirect to web.whatsapp.com opens unsolicited navigation.
• 10+ external wascript.com.br / watools.com.br endpoints contacted with no CSP; opaque data flows.
• function_constructor (new Function) in content script running on WhatsApp Web is a code-execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com on install.
• external_hosts crx 10 external wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP to restrict them.
• function_constructor crx new Function() found in content script — arbitrary code construction at WhatsApp Web runtime.
• dom_xss_sink crx innerHTML assigned from variable in content script on WhatsApp Web; no CSP to mitigate.
• reputation_unverified store No verified publisher, not featured; developer 'whscl' with 14 installs and no rating.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit restriction on connect-src or script-src.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; low direct harm alone.
• storage low Standard local key-value storage; minimal risk.
• alarms low Scheduling API; no data access.
• tabs medium Reads tab URLs/titles; moderate privacy surface on WhatsApp sessions.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all WhatsApp traffic in-page.

Pillar Scores

Bookkeeping