Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (D hardening → +10.0).
• Uninstall URL hijack flag set and install URL hijack to https://web.whatsapp.com — URL hijacking signals.
• Brand impersonation: extension uses 'google' brand name in privacy policy URL without being a verified Google publisher.
• 11 distinct external JS hosts under wascript.com.br / watools.com.br contacted from WhatsApp Web context — high reach on sensitive messaging.
• function_constructor (new Function()) and innerHTML sink found in scanned JS — code execution and DOM-XSS risk.

Evidence

• privacy_policy_generic_google store Privacy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true → D hardening +10.0.
• install_url_hijack crx install_url_hijack=true targeting https://web.whatsapp.com on install event.
• uninstall_url_hijack crx uninstall_url_hijack=true; target null but flag set — webstore rule +3.0.
• brand_impersonation store brand_mention.is_impersonation=true (google), confirmed_owner=false, not verified publisher.
• external_js_hosts crx 11 external hosts under wascript.com.br & watools.com.br; >3 distinct registrable domains → network +1.5.
• code_function_constructor crx new Function() constructor found in JS — maps to function_constructor signal (+2.5 code quality).
• dom_sink_innerhtml crx innerHTML from variable; csp_present=false elevates to +2.0 code quality.
• no_csp manifest content_security_policy=null; MV3 has strict default but no explicit CSP amplifies dom_sink risk.

Permissions Breakdown

• unlimitedStorage low Local storage quota expansion; low direct risk.
• storage low Standard local key-value storage; low risk.
• alarms low Scheduling; low risk on its own.
• tabs medium Can read tab URLs/titles across sessions; moderate risk.
• https://web.whatsapp.com/* medium Scoped host permission — narrows blast radius to WhatsApp Web only.

Pillar Scores

Bookkeeping