Top Risks

• WhatsApp brand impersonation by unverified developer with no confirmed ownership.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Uninstall URL hijack detected; extension tampers with post-uninstall flow.
• Install redirect opens web.whatsapp.com on install — possible session capture or tracking.
• 10 external wascript.com.br / watools.com.br endpoints contacted; large undisclosed backend surface.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed Meta/WhatsApp owner.
• privacy_policy_generic store Policy URL is Google myaccount generic policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but hijack flag set — post-uninstall behavior tampered.
• install_url_hijack crx install_url_hijack=true; opens https://web.whatsapp.com on install — potential session capture.
• large_external_host_surface crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; broad undisclosed backend.
• function_constructor crx new Function() constructor found in content JS — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS risk on sensitive page.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with external hosts and code quality findings.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; minimal direct harm but could cache sensitive data.
• storage low Standard local key-value storage; low risk in isolation.
• alarms low Schedules background tasks; low risk.
• tabs medium Can read tab URLs and titles across sessions; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; content scripts can read all messages on that page.

Pillar Scores

Bookkeeping