Top Risks

• Uninstall and install URL hijack detected — classic monetization/surveillance shell pattern.
• Privacy policy is Google's generic policy, not scoped to this extension; data collection and 3rd-party sharing admitted.
• Brand impersonation: Google brand mentioned but developer domain is extensao.store, not confirmed owner.
• 10 external JS hosts on wascript.com.br/watools.com.br contacted — large exfil surface for a narrow WhatsApp CRM.
• function_constructor (new Function) and innerHTML DOM-XSS sink found; no CSP to mitigate.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; classic monetization/tracking shell fingerprint.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — redirects user on install.
• privacy_policy_generic store Policy URL is Google's global privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for Google; developer domain extensao.store not confirmed owner.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br external hosts; broad outbound surface for a WhatsApp CRM.
• function_constructor crx new Function() constructor found in JS — dynamic code execution risk.
• dom_sink_innerhtml crx innerHTML assignment from variable with no CSP present — DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit hardening).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but could cache sensitive data.
• storage low Standard local storage access.
• alarms low Scheduling background tasks; low direct risk.
• tabs medium Can read tab URLs and metadata; moderate risk when combined with host access.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; narrow but sensitive — can read/write chat content.

Pillar Scores

Bookkeeping