Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — KASAPP [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection + 3rd-party sharing: +10 privacy.
• Brand impersonation of WhatsApp and Google by unverified developer 'whscl' at extensao.store.
• Uninstall URL hijack and install URL hijack detected — classic traffic/monetization shell pattern.
• 10 distinct external wascript.com.br/watools.com.br endpoints contacted from content script on WhatsApp Web.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands: whatsapp, google; developer extensao.store is not confirmed owner.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com — monetization shell signals.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br hosts contacted; extension operates as thick backend client on WhatsApp Web.
• function_constructor crx new Function() in content script on WhatsApp Web allows dynamic code execution at runtime.
• no_csp crx csp_present=false on MV3; combined with function_constructor and innerHTML sink elevates code quality risk.
• unverified_developer store verified_publisher=false, is_featured=false; developer 'whscl' at extensao.store; 12 installs only.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script; no CSP + cve_findings empty but sink is unguarded.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — KASAPP [adware] + malext.io malicious_extension_sentry; score 5.46 -> 7.96 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm but enables bulk data caching.
• storage low Standard key-value storage for extension state.
• alarms low Schedule periodic tasks; low risk in isolation.
• tabs medium Can read tab URLs and metadata across all open tabs.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all WhatsApp content including messages.

Pillar Scores

Bookkeeping