Top Risks

• Privacy policy points to Google's generic policy — admits data collection and 3rd-party sharing without scoping to this extension.
• WhatsApp brand impersonation by unverified developer 'wty' at extensao.store.
• Uninstall and install URL hijacks detected — classic monetization/tracking shell pattern.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no CSP — broad network exfil surface on WhatsApp Web.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in extension code.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true; classic monetization/tracking shell signals.
• generic_privacy_policy store Privacy policy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 12 external JS hosts including api-whatsapp.wascript.com.br, backend-plugin.wascript.com.br, code.wascript.com.br — broad reach into WhatsApp session.
• function_constructor crx new Function() constructor found in JS bundle — dynamic code execution risk.
• no_csp manifest csp_present=false on MV3 extension with external hosts and DOM sinks — no injection mitigation.
• developer_identity store Developer name 'wty' is minimal; not verified publisher; email domain extensao.store is a .store TLD registrar-tier domain.
• low_install_count store Only 16 installs; extension is nascent with no ratings — limited trust signal and tail-attack-surface concern.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low direct harm but enables caching exfil data.
• storage low Standard local key-value storage; minimal risk alone.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Access to tab URLs and metadata; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; can read/modify messages and contact data.

Pillar Scores

Bookkeeping