Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Cresça & Apareça CRM [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Free-webmail dev (gmail) with generic alias 'ext.user003' — unverifiable identity, no business backing.
• WhatsApp brand impersonation: confirmed_owner=false, operates inside WhatsApp Web via content script.
• Content script on web.whatsapp.com can read/exfiltrate chat messages; DOM-XSS sink present with no CSP.
• Install URL hijack opens web.whatsapp.com on install — minor UX manipulation signal.

Evidence

• free_webmail_dev_no_business store Developer email pietrogabrielg20@gmail.com; developer_name is generic alias 'ext.user003'; no business domain.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for 'whatsapp'; developer is not confirmed owner of WhatsApp.
• content_script_sensitive_origin manifest Content script injected into https://web.whatsapp.com/* — full DOM access to user messages.
• dom_xss_sink_no_csp crx innerHTML sink in vendor.BaH-a-x7.js; csp_present=false on MV3 extension — elevated XSS risk.
• install_url_hijack manifest install_url_hijack=true; onInstalled redirects to https://web.whatsapp.com — monetization/UX signal.
• privacy_policy_third_party_sas store Privacy policy at opt-api.com (third-party SaaS); third_party_sharing=true; not dev-controlled domain.
• external_js_hosts crx JS contacts hc-stt.hiperchat.com.br, locize.com, reactjs.org, web.whatsapp.com, www.i18next.com (3 countries).
• very_low_install_count store Only 3 installs; unverified publisher; no ratings — minimal trust signals, high tail-risk profile.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Cresça & Apareça CRM [data-theft] + malext.io malicious_extension_sentry; score 2.63 -> 5.13 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct privacy risk but can cache large data.
• storage low Standard local storage access; low risk.
• tabs medium Can read tab URLs and titles; moderate info-disclosure risk.
• alarms low Scheduling only; no direct data access.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM on that origin.

Pillar Scores

Bookkeeping