Top Risks

• Privacy policy is Google's generic policy — does NOT scope to this extension; admits data collection & 3rd-party sharing.
• Uninstall URL hijack + install URL hijack detected; onInstalled opens web.whatsapp.com (suspicious routing).
• WhatsApp brand impersonation by unverified developer on extensao.store domain.
• 10 external wascript.com.br / watools.com.br endpoints contacted; no CSP; function_constructor in JS.
• Google generic privacy policy linked — classified as scope_extension=false with data_collection=true and third_party_sharing=true.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• external_hosts crx 10 distinct wascript.com.br and watools.com.br subdomains in js_external_hosts; no CSP on MV3.
• function_constructor crx new Function() usage found in content script — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS risk.
• install_url_hijack_webstore store install_url_hijack=true; +2.0 webstore penalty applied per rubric.
• unverified_developer store verified_publisher=false, is_featured_by_google=false, developer_name='wspd', 71 installs.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard local key-value storage; low risk.
• alarms low Periodic background execution; low risk alone.
• tabs medium Can read tab URLs and titles across all tabs; moderate surveillance capability.
• https://web.whatsapp.com/* medium Content script + host access on WhatsApp Web; can read/write all chat content.

Pillar Scores

Bookkeeping