Top Risks

• Privacy policy is Google's own policy — does not scope to this extension; effectively no extension-specific policy.
• Brand impersonation: WhatsApp mentioned prominently, developer domain not affiliated with Meta.
• Uninstall & install URL hijack both present; install redirects to web.whatsapp.com signaling tracking or onboarding manipulation.
• 10+ external JS hosts under wascript.com.br/watools.com.br with no CSP — broad remote code surface on MV3 extension.
• operator_cluster sibling detected; coordinated extension cluster pattern increases supply-chain risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijacks set; install redirects to https://web.whatsapp.com.
• privacy_policy_generic store Policy URL is Google's own account policy — scope_extension==false, data_collection==true, third_party_sharing==true.
• brand_impersonation store brand_mention.is_impersonation==true for WhatsApp; developer domain extensao.store not affiliated with Meta.
• js_external_hosts crx 10 distinct external hosts under wascript.com.br and watools.com.br; no CSP to constrain them.
• operator_cluster_sibling api sibling_count==1 (cellckcnenolgakggljkichbmgmbibgb) sharing dev email, install URL, and host set.
• function_constructor crx new Function() detected in scanned JS — dynamic code execution risk without CSP.
• dom_sink_innerhtml_userctrl crx Uncontrolled innerHTML assignment found; no CSP present, raising DOM-XSS risk.
• no_csp manifest content_security_policy is null on MV3 extension with 10 remote hosts and code-execution findings.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large local data accumulation.
• storage low Standard local storage access; low risk in isolation.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles across sessions; moderate privacy surface.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web only; matched to stated CRM function.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping