Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — G5 Chat [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Operator cluster of 6 sibling extensions under same dev email — large coordinated attack surface.
• WhatsApp brand impersonation: confirmed_owner=false, developer is extensao.store not Meta.
• Privacy policy is Google's own policy — no scope to this extension; data collection & 3rd-party sharing admitted without extension scope.
• Uninstall URL hijack and install URL hijack detected — classic monetization/tracking shell behavior.

Evidence

• operator_cluster_siblings api 6 sibling extensions share same dev email, install URL, and CSP host-set — coordinated operator cluster.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; install_url_hijack also true redirecting to web.whatsapp.com on install.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true — +10.0 privacy.
• function_constructor crx new Function() in content script running on WhatsApp Web — dynamic code execution risk.
• dom_sink_innerhtml_no_csp crx innerHTML DOM-XSS sink with csp_present=false — escalated to +2.0 per FIX B.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints; >3 distinct registrable domains contacted.
• no_csp_mv3 manifest content_security_policy=null; MV3 so no +2.0 network penalty, but amplifies code findings.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — G5 Chat [adware] + malext.io malicious_extension_sentry; score 6.34 -> 8.84 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but can cache sensitive WhatsApp data.
• storage low Standard key-value storage; low risk on its own.
• alarms low Scheduled wake-ups; low risk, used for automation timing.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function but grants full DOM access to all conversations.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping