Top Risks

• Google privacy policy used as extension policy: admits data collection & 3rd-party sharing, not scoped to this extension.
• Uninstall URL hijack + install URL hijack to web.whatsapp.com — unsolicited navigation on install/uninstall.
• Brand impersonation: Google brand mentioned; policy URL is Google's own, developer not a confirmed Google entity.
• 10 external wascript.com.br / watools.com.br endpoints called from a 6-install WhatsApp CRM with no CSP.
• function_constructor (new Function) + unguarded innerHTML in content script running on WhatsApp chat context.

Evidence

• uninstall_url_hijack + install_url_hijack crx Extension sets uninstall URL hijack=true and install redirect to https://web.whatsapp.com on every install.
• google_policy_impersonation store Privacy policy points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for Google; developer not verified publisher nor Google entity.
• external_hosts_breadth crx 12 js_external_hosts across wascript.com.br and watools.com.br domains; no CSP to constrain them.
• function_constructor crx new Function() in content script running inside web.whatsapp.com — arbitrary code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in WhatsApp content script with no CSP; DOM-XSS sink.
• privacy_policy_generic_google store Policy is Google's generic account policy (479 KB); no mention of ZAZMAX extension data handling.
• tiny_install_base api Only 6 installs; unverified developer 'whscl' on extensao.store; no ratings or reviews.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low abuse potential alone.
• storage low Standard local key-value storage, limited scope.
• alarms low Scheduling only; no direct data access.
• tabs medium Can read tab URLs/titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp; content scripts can read all chat data there.

Pillar Scores

Bookkeeping