Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — BALTZ CRM [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Operator cluster: 5 sibling extensions under same dev email/fingerprint — factory-pattern shell risk.
• WhatsApp impersonation brand signal + unverified dev (extensao.store) with Google privacy policy as cover.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits collection without scoping to this extension.
• Uninstall URL hijack flagged; install hijack redirects to web.whatsapp.com; 10 external wascript.com.br/watools.com.br hosts with no CSP.

Evidence

• operator_cluster_siblings api 5 sibling extensions share same dev email, install URL, and external host fingerprint — factory/shell cluster.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted; no CSP restricting them.
• function_constructor crx new Function() constructor in content script — dynamic code execution risk inside WhatsApp Web.
• dom_xss_sink crx innerHTML assigned from variable in content script with no CSP; DOM-XSS risk in WhatsApp context.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit CSP restricts external JS hosts.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — BALTZ CRM [adware] + malext.io malicious_extension_sentry; score 3.78 -> 6.28 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct risk but pairs with CRM data accumulation.
• storage low Standard key-value storage; low risk.
• alarms low Schedules periodic tasks; low risk on its own.
• tabs medium Can read tab URLs and titles across the browser; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function but enables full DOM/message access.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping