Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com.
• 10+ external JS hosts under wascript.com.br/watools.com.br — large undisclosed backend surface on WhatsApp chat data.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in scanned JS with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy crx Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true redirecting to https://web.whatsapp.com.
• large_external_host_surface crx 12 js_external_hosts including api-whatsapp, backend-plugin, audio-transcriber, code.wascript.com.br etc.
• function_constructor crx new Function() constructor found in v_7_4_3_80...6193.js — dynamic code execution risk.
• dom_xss_sink_no_csp crx innerHTML from variable in v_7_4_3_80...12.js; csp_present=false amplifies XSS risk.
• no_csp_mv3 manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction on connect-src.
• reputation_unverified store verified_publisher=false, is_featured_by_google=false, developer Intzp has no recognized org status.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but can mask data hoarding.
• storage low Standard local key-value storage; low risk.
• alarms low Scheduled tasks; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; but CRM use implies reading chat content.

Pillar Scores

Bookkeeping