Top Risks

• Operator cluster: 5 sibling extensions under same dev email/fingerprint — factory-pattern shell risk.
• WhatsApp impersonation brand signal + unverified dev (extensao.store) with Google privacy policy as cover.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — admits collection without scoping to this extension.
• Uninstall URL hijack flagged; install hijack redirects to web.whatsapp.com; 10 external wascript.com.br/watools.com.br hosts with no CSP.
• function_constructor + innerHTML DOM-XSS sink in content script running inside WhatsApp Web with no CSP guard.

Evidence

• operator_cluster_siblings api 5 sibling extensions share same dev email, install URL, and external host fingerprint — factory/shell cluster.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted; no CSP restricting them.
• function_constructor crx new Function() constructor in content script — dynamic code execution risk inside WhatsApp Web.
• dom_xss_sink crx innerHTML assigned from variable in content script with no CSP; DOM-XSS risk in WhatsApp context.
• no_csp crx content_security_policy is null; MV3 default applies but no explicit CSP restricts external JS hosts.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct risk but pairs with CRM data accumulation.
• storage low Standard key-value storage; low risk.
• alarms low Schedules periodic tasks; low risk on its own.
• tabs medium Can read tab URLs and titles across the browser; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function but enables full DOM/message access.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Scoring History

Bookkeeping