Top Risks

• Operator cluster of 4 siblings under same dev email — likely coordinated extension farm targeting WhatsApp Web users.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and third-party sharing.
• Uninstall URL hijack active; install redirects to web.whatsapp.com — traffic manipulation signals.
• WhatsApp brand impersonation by unverified developer (ewdht / extensao.store) with only 7 installs.
• No CSP + function_constructor + innerHTML sink — code execution risk against WhatsApp Web DOM.

Evidence

• operator_cluster_siblings api 4 sibling extensions share same dev email, install URL, and CSP host set — coordinated farm pattern.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install also redirects to web.whatsapp.com.
• brand_impersonation store Extension mentions 'WhatsApp' brand; developer (ewdht/extensao.store) is not a confirmed Meta/WhatsApp owner.
• generic_privacy_policy api Privacy policy URL is Google's account policy — scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted — broad backend surface for 7-install extension.
• function_constructor crx new Function() found in bundled JS; no CSP to mitigate dynamic code execution.
• dom_xss_sink crx innerHTML assigned from variable without CSP or trusted-types protection.
• no_csp crx content_security_policy is null (MV3 default applies but no explicit hardening declared).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; modest risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling API; low risk on its own.
• tabs medium Access to tab URLs/titles across browser; medium risk.
• host:https://web.whatsapp.com/* medium Content script on WhatsApp Web; can read all messages and DOM.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Scoring History

Bookkeeping