Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; install redirect opens web.whatsapp.com.
• Brand impersonation of WhatsApp by unverified developer on extensao.store domain.
• Operator cluster has 2 sibling extensions under same fingerprint — coordinated publishing pattern.
• 10 external wascript.com.br/watools.com.br hosts contacted; large backend surface with no CSP.

Evidence

• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack=true pointing to https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer not confirmed owner of extensao.store.
• operator_cluster_siblings api sibling_count=2 under same dev-email/install-url/host fingerprint; IDs: cellckcnenolgakggljkichbmgmbibgb, aocojboaoklgedadlpaallelnanhcpgm.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains contacted; large unverified backend surface.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web — XSS risk on sensitive messaging context.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP hardening declared.

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct abuse potential.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs/titles across all tabs, moderate privacy exposure.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; can read/modify all page content and messages.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping