Top Risks

• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; install redirects user to web.whatsapp.com on onInstalled.
• Brand impersonation: mentions 'google' in metadata but developer is unverified and not Google.
• 10+ external JS hosts under wascript.com.br/watools.com.br contacted by extension at runtime.
• function_constructor (new Function) and uncontrolled innerHTML sink increase XSS/code-injection risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() called; uninstall_url_hijack=true. Webstore +3.0.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com; install_url_hijack=true. Webstore +2.0.
• brand_impersonation store brand_mention lists 'google', confirmed_owner=false, is_impersonation=true; not verified/featured. Rep +2.0.
• generic_privacy_policy api Policy is Google's account policy: scope_extension=false, data_collection=true, 3rd_party_sharing=true. Privacy +10.0.
• external_js_hosts crx 11 distinct external hosts under wascript.com.br and watools.com.br; >3 distinct registrable domains. Net +1.5.
• function_constructor crx new Function() constructor found in bundled JS — code quality +2.5.
• dom_sink_innerhtml_userctrl crx Uncontrolled innerHTML sink; csp_present=false → elevated scoring applies. Code +2.0.
• ai_extension_page_content store AI CRM extension on WhatsApp Web processes full conversation content. Webstore +2.5.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large local data caching.
• storage low Standard local key-value storage; minimal risk alone.
• alarms low Schedules recurring tasks; low risk but enables persistent background activity.
• tabs medium Can read tab URLs and titles; medium risk for user activity tracking.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web only; enables reading/writing all WhatsApp content.

Pillar Scores

Bookkeeping