Top Risks

• Uninstall & install URL hijack: extension redirects browser on install/uninstall to third-party URLs.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Google brand impersonation: links to myaccount.google.com as privacy policy without being a Google product.
• 10 external JS hosts under wascript.com.br / watools.com.br contacted at runtime — broad exfil surface over WhatsApp data.
• function_constructor + innerHTML DOM-XSS sink with no CSP — code execution risk in WhatsApp Web context.

Evidence

• install_url_hijack crx install_url_hijack=true; target https://web.whatsapp.com opened on install.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — classic monetization/tracking pattern.
• brand_impersonation store brand_mention lists 'google'; confirmed_owner=false; privacy policy links to Google's own account page.
• privacy_policy_generic api Policy is Google's global policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br hosts contacted; broad backend surface for WhatsApp CRM data.
• function_constructor crx new Function() found in scanned JS; dynamic code execution risk, no CSP to mitigate.
• no_csp manifest content_security_policy is null; DOM-XSS and dynamic eval risks unmitigated.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS sink.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard local key-value storage; low risk alone.
• alarms low Scheduling API; low risk, enables background tasks.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Scoped host permission; grants content-script access to WhatsApp Web messages.

Pillar Scores

Bookkeeping