Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall AND install URL hijack detected; installs open WhatsApp, uninstall redirected externally.
• WhatsApp brand impersonation by unverified developer (extensao.store) — not a Meta/WhatsApp affiliate.
• 10+ external JS hosts on wascript.com.br/watools.com.br loaded from within WhatsApp session — broad exfil surface.
• function_constructor usage detected; no CSP — remote code or eval-based execution risk on WhatsApp content.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall URL hijacks confirmed; install opens web.whatsapp.com, uninstall target present.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta-affiliated.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 12 external JS hosts, 10 on wascript.com.br/watools.com.br; no CSP; MV3 but broad outbound surface.
• function_constructor crx new Function() in v_7_4_3_80_...193.js — potential dynamic code execution on WhatsApp session.
• dom_sink_innerhtml_userctrl crx innerHTML assignment from variable in v_7_4_3_80_...12.js; no CSP — DOM-XSS sink risk.
• no_verified_publisher_no_featured store Developer Intzp / contato@extensao.store; no verified publisher badge; no featured badge; 37 installs only.
• install_url_hijack_target manifest install_url_target=https://web.whatsapp.com — onInstalled redirects user to WhatsApp (lure pattern).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data retention.
• storage low Standard key-value storage; low risk alone.
• alarms low Scheduling only; minimal risk.
• tabs medium Can read tab URLs and titles; moderate risk when paired with WhatsApp host access.
• https://web.whatsapp.com/* medium Content-script + host access on WhatsApp — can read/modify all WhatsApp messages and UI.

Pillar Scores

Bookkeeping