Top Risks

• Uninstall URL hijack active — extension intercepts browser uninstall flow to redirect user.
• Install URL hijack opens web.whatsapp.com on install — unsolicited navigation.
• Privacy policy is Google's generic policy — not scoped to this extension, but admits data collection and 3rd-party sharing (+10 privacy).
• Brand impersonation: 'google' mentioned in brand_mention with confirmed_owner=false.
• 10 distinct external wascript.com.br/watools.com.br hosts contacted — large undisclosed backend surface on WhatsApp CRM.

Evidence

• uninstall_url_hijack crx uninstall_url_hijack=true; extension hooks chrome.runtime.setUninstallURL to intercept user uninstall.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://web.whatsapp.com — forced navigation.
• generic_privacy_policy store Privacy policy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention lists 'google'; confirmed_owner=false; developer domain extensao.store is unrelated.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; undisclosed backend.
• function_constructor crx new Function() constructor found in JS — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable without CSP; csp_present=false amplifies DOM-XSS risk.
• no_csp manifest content_security_policy=null; no CSP declared on MV3 extension; amplifies code-quality findings.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; low direct harm alone.
• storage low Standard key-value storage; minimal risk.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs/titles; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/inject content on that site.

Pillar Scores

Bookkeeping