Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0 privacy).
• Uninstall and install URL hijacks detected; install redirects to web.whatsapp.com suggesting session interception setup.
• WhatsApp brand impersonation by unverified developer (extensao.store) with no verified publisher badge.
• 10+ distinct external wascript.com.br / watools.com.br hosts contacted, with no CSP; high exfil surface on WhatsApp chat data.
• function_constructor (new Function) + innerHTML DOM-XSS sink found in content script running inside WhatsApp Web.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall URL hooks present; install target is web.whatsapp.com suggesting forced navigation.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not affiliated with Meta.
• generic_google_privacy_policy store Privacy URL points to myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → worst-case privacy: admits collection without scope.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints in JS; no CSP; broad outbound from WhatsApp content script.
• function_constructor crx new Function() found in content script; combined with innerHTML sink, elevates code-quality risk.
• no_csp manifest csp_present=false on MV3 extension; dom_sink_innerhtml_userctrl escalated to +2.0 under FIX B.
• low_install_count store Only 11 installs with 334 JS files and 10+ external hosts — extremely high surface area for near-zero user base.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables data hoarding.
• storage low Standard local key-value storage; low risk.
• alarms low Periodic background wake; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web; enables content script injection into chat sessions.

Pillar Scores

Bookkeeping