Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (score +10).
• WhatsApp brand impersonation by unverified developer (contao@extensao.store / 'Intzp'); confirmed_owner=false.
• Uninstall URL hijack and install URL hijack both flagged — classic monetization/tracking shell signal.
• 10 distinct external hosts under wascript.com.br / watools.com.br contacted; broad backend surface with no CSP.
• new Function() constructor in content script running against WhatsApp Web — code-execution risk on sensitive page.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy api Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — monetization/tracking pattern.
• install_url_hijack crx install_url_hijack=true; target=https://web.whatsapp.com — opens page on install.
• broad_external_hosts crx 10 distinct external hosts (wascript.com.br, watools.com.br subdomains) with no CSP; MV3 but no policy.
• function_constructor crx new Function() in content script on WhatsApp Web enables dynamic code execution.
• no_csp manifest content_security_policy=null; csp_present=false with 334 JS files and external hosts.
• developer_identity store Developer 'Intzp', email contato@extensao.store; not verified publisher, not featured.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm, enables large data caching.
• storage low Standard local key-value storage; minimal risk.
• alarms low Scheduled background tasks; low risk on its own.
• tabs medium Can read URLs and titles of open tabs; moderate privacy surface.
• host_permissions: https://web.whatsapp.com/* medium Full script/XHR access to WhatsApp Web; scoped but sensitive (messages, contacts).

Pillar Scores

Bookkeeping