Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and third-party sharing.
• Uninstall and install URL hijacks detected; install redirects to web.whatsapp.com but pattern is abuse-associated.
• WhatsApp impersonation: brand_mention.is_impersonation=true; developer domain extensao.store not affiliated with Meta.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted; broad backend surface for a 126-install CRM.
• function_constructor (new Function) found in scanned JS; no CSP present on MV3 extension.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and uninstall URL hooks active; install redirects to web.whatsapp.com — monetization/tracking pattern.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to MI CIERRO; data_collection+third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer extensao.store is not confirmed Meta owner.
• js_external_hosts_count crx 12 external JS host entries, 10 distinct wascript.com.br/watools.com.br subdomains — large backend surface for 126 installs.
• function_constructor crx new Function() in v_7_4_3_80_...193.js; combined with no CSP raises code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script on WhatsApp Web — DOM-XSS sink; no CSP to mitigate.
• no_csp_mv3 manifest content_security_policy is null; MV3 default applies but no explicit hardening despite dynamic code usage.
• low_install_count store Only 126 installs; combined with impersonation and hijack flags suggests early-stage or niche distribution.

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct risk.
• storage low Standard local key-value storage.
• alarms low Scheduling; low risk on its own.
• tabs medium Can read tab URLs and titles across all open tabs.
• https://web.whatsapp.com/* (host) medium Full DOM access on WhatsApp Web; can read messages and session data.

Pillar Scores

Bookkeeping