Top Risks

• Privacy policy is Google's generic policy—does NOT scope to this extension; data collection + 3rd-party sharing admitted with no extension-specific disclosure.
• WhatsApp brand impersonation by unverified developer (extensao.store); confirmed_owner==false.
• Uninstall URL hijack + install URL hijack flagged; onInstalled redirects user to web.whatsapp.com.
• 10 distinct external wascript.com.br / watools.com.br backend hosts with no CSP; broad exfiltration surface for WhatsApp message data.
• function_constructor (new Function) detected in content script running on WhatsApp Web; enables dynamic code execution against message context.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store, confirmed_owner=false.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• install_uninstall_hijack manifest uninstall_url_hijack=true and install_url_hijack=true; install target=https://web.whatsapp.com.
• external_backend_hosts crx 10 distinct wascript.com.br/watools.com.br hosts contacted; no CSP; full WhatsApp DOM access creates exfil risk.
• function_constructor crx new Function() in content script on WhatsApp Web; allows dynamic code execution against message data.
• dom_xss_sink crx innerHTML assigned from variable in content script; DOM-XSS risk on WhatsApp Web with no CSP.
• no_csp manifest content_security_policy=null; csp_present=false; amplifies code-quality findings.
• unverified_developer store verified_publisher=false, not featured; developer 'wspd' at extensao.store; no recognized org.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; low direct harm but enables data hoarding.
• storage low Standard extension key-value storage; minimal risk.
• alarms low Scheduled tasks; low risk in isolation.
• tabs medium Can read tab URLs and titles across sessions; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; grants full DOM/message access on that origin.

Pillar Scores

Bookkeeping