Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack both active; install redirects to web.whatsapp.com but mechanism is abusable.
• WhatsApp brand impersonation: developer domain extensao.store is not Meta/WhatsApp-owned.
• 10+ external backend hosts (wascript.com.br, watools.com.br) receive data from WhatsApp Web sessions.
• No developer name disclosed; privacy policy is a generic Google URL with no extension-specific scope.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hooks set; +3.0 each in webstore scoring (uninstall target null, install→web.whatsapp.com).
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• 10 external backend hosts crx js_external_hosts includes wascript.com.br (8 subdomains), watools.com.br — all outside developer's listed domain.
• no developer name store developer_name is empty string; +1.0 Reputation penalty.
• function_constructor crx new Function() call detected; +2.5 Code Quality (function_constructor signal).
• dom_sink_innerhtml_userctrl + no CSP crx innerHTML sink with csp_present=false → elevated to +2.0 Code Quality (FIX B applies).
• verified_publisher store verified_publisher=true; -3.0 Reputation discount applied (no stale/CVE/monetization caps triggered).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but could cache sensitive WhatsApp data.
• storage low Standard local key-value storage; low risk in isolation.
• alarms low Scheduled background tasks; low risk.
• tabs medium Can read tab URLs/titles; combined with WhatsApp host access raises moderate risk.
• https://web.whatsapp.com/* medium Scoped host permission; narrows risk but grants full DOM access to WhatsApp messages.

Pillar Scores

Bookkeeping