Top Risks

• Privacy policy points to Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• Uninstall and install URL hijack both active; install redirects to web.whatsapp.com (obfuscation vector).
• WhatsApp brand impersonation: confirmed not an official Meta/WhatsApp product.
• 10+ external wascript.com.br / watools.com.br endpoints contacted from WhatsApp Web context — broad exfil surface.
• function_constructor and innerHTML DOM-XSS sink found in content scripts running on sensitive WhatsApp Web session.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not affiliated with Meta.
• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — D clause triggers +10.0.
• uninstall_url_hijack manifest uninstall_url_hijack=true and install_url_hijack=true; install target is https://web.whatsapp.com.
• external_hosts_volume crx 12 js_external_hosts including api-whatsapp, backend-plugin, audio-transcriber, painel-old under wascript.com.br.
• function_constructor crx new Function('return this') in content script — dynamic code execution capability in WhatsApp Web context.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script; no CSP present — elevated DOM-XSS risk.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit restriction on connect-src to wascript domains.
• ai_extension_page_content store CRM/AI extension processes WhatsApp Web messages; is_ai_extension=true adds exfil surface concern.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but can be abused for caching exfiltrated data.
• storage low Standard key-value store; low risk on its own.
• alarms low Scheduling API; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Full access to WhatsApp Web DOM including messages; significant data sensitivity.

Pillar Scores

Bookkeeping