Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• Uninstall URL hijack and install URL hijack both flagged, redirecting users to third-party on install/removal.
• WhatsApp brand impersonation: extension targets web.whatsapp.com but developer is unverified and domain is extensao.store.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted; broad outbound network surface with no CSP.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in scanned JS files; MV3 no CSP amplifies DOM risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijacks flagged; install redirects to https://web.whatsapp.com on install event.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_google_privacy_policy store Privacy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• broad_external_hosts crx 12 JS external hosts across wascript.com.br and watools.com.br subdomains; no CSP to restrict them.
• function_constructor crx new Function() constructor found in content JS; code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script on web.whatsapp.com; DOM-XSS risk, no CSP present.
• no_csp_mv3 manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction on connect-src.
• unverified_low_install_whatsapp_crm store 126 installs, no verified publisher badge, developer 'wsll' with email contato@extensao.store.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but can cache large data.
• storage low Standard key-value storage, low risk.
• alarms low Scheduling alarms; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Content script + host access to WhatsApp Web; can read messages and DOM.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Scoring History

Bookkeeping