Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Brand impersonation: mentions WhatsApp and Google but developer domain (extensao.store) is unrelated to either.
• Uninstall URL hijack and install URL hijack both flagged; classic traffic-capture pattern.
• 10+ external wascript.com.br / watools.com.br endpoints contacted; large opaque backend surface on WhatsApp chat data.
• new Function() constructor present and no CSP; DOM-XSS innerHTML sink also detected.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp+Google; developer domain extensao.store not affiliated.
• privacy_policy_generic store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• uninstall_url_hijack manifest uninstall_url_hijack=true; classic traffic-hijack / re-engagement pattern.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com.
• external_hosts_broad crx 12 js_external_hosts under wascript.com.br and watools.com.br; large opaque API surface with WhatsApp session data.
• function_constructor crx new Function() in v_7_4_3_80_...193.js; dynamic code execution risk, no CSP mitigates.
• dom_xss_sink crx innerHTML user-controlled sink in v_7_4_3_80_...12.js; no CSP present (csp_present=false).
• unverified_developer store verified_publisher=false, is_featured_by_google=false, install_count=4, developer Intzp unknown.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm potential.
• storage low Standard local key-value store; low risk.
• alarms low Background scheduling only; low risk.
• tabs medium Can read tab URLs and metadata across sessions; moderate risk.
• https://web.whatsapp.com/* medium Content-script + host access on WhatsApp Web; can read all chat data.

Pillar Scores

Bookkeeping