Top Risks

• Uninstall URL hijack detected — redirects user on uninstall, classic monetization/tracking pattern.
• Install URL hijack opens third-party URL (web.whatsapp.com) on install without user consent.
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Brand impersonation: extension uses Google branding but developer is not confirmed Google owner.
• 10+ distinct external JS hosts under wascript.com.br/watools.com.br with no CSP — broad remote code surface on WhatsApp Web.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() called; redirects on uninstall — Webstore +3.0.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — Webstore +2.0.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not verified owner — Reputation +2.0.
• generic_privacy_policy api Policy URL is Google's account privacy policy; scope_extension=false, data_collection=true, third_party_sharing=true — Privacy +10.0.
• no_csp manifest csp_present=false on MV3; dom_sink_innerhtml present — Code Quality dom_sink elevated to +2.0.
• external_js_hosts crx 12 external JS hosts across wascript.com.br and watools.com.br contacted; no CSP — Network >3 domains +1.5.
• function_constructor crx new Function() constructor detected — Code Quality +2.5.
• tiny_install_base store Only 6 installs; unverified developer 'Stfl'; no featured badge — elevated tail-risk profile.

Permissions Breakdown

• unlimitedStorage low Allows storing large amounts of data locally; low standalone risk.
• storage low Standard local storage; low risk.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and metadata; moderate risk when paired with content scripts.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; allows full page access and message interception.

Pillar Scores

Bookkeeping