Top Risks

• Uninstall+install URL hijack both set; extension redirects users to third-party on install/removal.
• Privacy policy is Google's own policy (not scoped to extension); admits data collection + 3rd-party sharing — worst-case privacy score.
• Brand impersonation: 'google' mentioned but developer is unverified non-Google entity (extensao.store).
• 10+ external JS hosts under wascript.com.br/watools.com.br — broad external dependency surface on a WhatsApp CRM with no CSP.
• function_constructor + innerHTML DOM-XSS sink with no CSP in MV3 extension injecting into WhatsApp.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijacks flagged; install redirects to https://web.whatsapp.com.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing=true.
• brand_impersonation store brand_mention lists 'google', confirmed_owner=false, is_impersonation=true; developer is extensao.store.
• broad_external_js_hosts crx 12 external JS hosts, 10 under wascript.com.br/watools.com.br; no CSP to constrain them.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assignment from variable in content script injected into WhatsApp; no CSP present.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with external hosts and code sinks.
• unverified_dev_low_installs store 30 installs, no verified publisher, developer name 'Stfl', email extensao.store — minimal accountability.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling only; minimal harm surface.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp; enables content script injection into messaging app.

Pillar Scores

Bookkeeping