Top Risks

• Uninstall URL hijack + install URL hijack both present — monetization/tracking red flags.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection + 3rd-party sharing.
• WhatsApp brand impersonation: developer domain extensao.store is not Meta/WhatsApp-affiliated.
• 10 external wascript.com.br / watools.com.br endpoints contacted; no CSP to restrict them.
• function_constructor usage in content script running on WhatsApp Web — code execution risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL hijack flagged; combined with install_url_hijack to https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer extensao.store is not a Meta affiliate.
• generic_privacy_policy store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• multiple_external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; no CSP to restrict.
• function_constructor crx new Function() in content script on WhatsApp Web DOM — maps to +2.5 code quality.
• dom_sink_innerhtml_userctrl crx innerHTML assignment without CSP and with eval-class finding present → +2.0 code quality (FIX B).
• no_csp manifest content_security_policy is null; MV3 has strict-default but js_external_hosts and function_constructor amplify risk.
• low_install_count store Only 9 installs; combined with WhatsApp impersonation and hijack signals suggests early-stage or test deployment.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low risk alone but notable with CRM data.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate risk in WhatsApp CRM context.
• https://web.whatsapp.com/* (host) medium Full access to WhatsApp Web DOM and messages; sensitive personal data.

Pillar Scores

Bookkeeping