Top Risks

• Uninstall URL hijack present — sends users to third-party on removal.
• Install URL hijack opens web.whatsapp.com on install — URL redirect pattern.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• WhatsApp brand impersonation: extension accesses WhatsApp Web and uses WhatsApp branding without being Meta-verified.
• 10+ distinct external JS host endpoints (all under wascript.com.br/watools.com.br) create large exfil surface over WhatsApp session data.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; target null but hijack flag set — webstore rule +3.0.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — third-party redirect on install, +2.0 webstore.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy api Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• external_js_hosts crx 11 distinct external hosts, all under wascript.com.br / watools.com.br — broad outbound surface on WhatsApp session.
• function_constructor crx new Function() usage in 193rd JS file; combined with no CSP elevates code quality risk.
• no_csp manifest csp_present=false on MV3 extension; dom_sink_innerhtml_userctrl present → +2.0 code quality (FIX B).
• unverified_dev store verified_publisher=false, not featured, developer name 'wspd' is opaque, email on extensao.store domain.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; moderate abuse potential for data hoarding.
• storage low Standard key-value store; low risk in isolation.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; can read/modify all WhatsApp content.

Pillar Scores

Bookkeeping