Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection & 3rd-party sharing (+10.0 privacy).
• WhatsApp brand impersonation by unverified developer 'ewdht' at extensao.store — confirmed is_impersonation flag.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com (tracking/affiliate vector).
• 11 external JS hosts (wascript.com.br, watools.com.br) contacted from a 24-install WhatsApp CRM — high exfil surface.
• function_constructor (new Function()) in content script running on WhatsApp Web — arbitrary code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_js_hosts crx 11 external hosts including api-whatsapp.wascript.com.br, backend-plugin.wascript.com.br, code.wascript.com.br.
• function_constructor crx new Function() constructor found in content script — arbitrary code execution vector on WhatsApp Web.
• dom_xss_sink crx innerHTML assigned from variable in content script; csp_present=false amplifies risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening against external host loading.
• unverified_developer store Developer 'ewdht', email contato@extensao.store; not verified publisher, not featured, 24 installs only.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low standalone risk.
• storage low Standard local data persistence.
• alarms low Scheduled tasks; minimal risk.
• tabs medium Can read tab URLs/titles across browser sessions.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web — plausible for CRM but grants full page access including messages.

Pillar Scores

Bookkeeping