Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• Uninstall URL hijack and install URL hijack both active; onInstalled redirects user to web.whatsapp.com.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10+ external wascript.com.br / watools.com.br endpoints contacted; no CSP on MV3 extension.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in bundled JS (334 files, no CSP).

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijacks set; install redirects to https://web.whatsapp.com.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store not confirmed Meta owner.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to Pangeia.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true — D clause triggers +10.0 privacy.
• js_external_hosts crx 10 external wascript.com.br/watools.com.br hosts contacted; >3 distinct registrable domains.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML from variable without CSP; DOM-XSS sink on WhatsApp Web content script.
• developer_identity store Dev name 'ewdht' is opaque; not verified publisher; not featured by Google.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling only; low risk.
• tabs medium Can read tab URLs and titles; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; enables content script injection on messaging platform.

Pillar Scores

Bookkeeping