Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — crmNOW [data-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy fetched but does not scope to this extension and omits data collection details.
• Three innerHTML sinks without CSP — DOM-XSS risk on WhatsApp Web page context.
• No developer name listed in store; brand_mention flags Google impersonation signal.
• Content script reads WhatsApp Web conversations; sensitive chat data accessible.

Evidence

• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=false — generic policy not specific to this extension.
• dom_xss_sinks crx 3 innerHTML assignments from variables in background.js, scripts.js, content.js — DOM-XSS sinks.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not a confirmed Google owner.
• no_developer_name store developer_name is empty string; no 'Offered by' identity disclosed in store listing.
• whatsapp_host_access manifest Content script injected into web.whatsapp.com — can access full chat conversation content.
• no_csp manifest content_security_policy is null; csp_present=false — no explicit CSP hardening.
• low_install_count store 547 installs; niche CRM tool for estoquenow.com.br — limited blast radius.
• clean_threat_intel api No bad_host_hits, monetization_hits, or affiliate_hits; developer domain resolves and not throwaway.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — crmNOW [data-theft] + malext.io malicious_extension_sentry; score 3.22 -> 5.72 (+2.5 cap 2.5).

Permissions Breakdown

• scripting medium Can inject JS into whatsapp.com pages; scoped to activeTab reduces blast radius.
• activeTab low Grants access only to the currently active tab on user gesture.
• storage low Local extension storage; no cross-origin data exposure.
• host: https://web.whatsapp.com/* medium Content script runs on WhatsApp Web; can read conversation content.
• host: https://api.estoquenow.com.br/* low Developer-owned API endpoint; narrowly scoped to own backend.

Pillar Scores

Bookkeeping