Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WANQUEST - CONECTE, AUTOMATIZE E CRESÇA [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is a generic Google URL that failed to fetch — no extension-scoped data handling disclosed.
• WhatsApp impersonation: brand_mention.is_impersonation=true, developer is not a confirmed WhatsApp owner.
• function_constructor (new Function) in content script running inside WhatsApp Web enables arbitrary code execution.
• innerHTML DOM-XSS sink with no CSP in MV3 extension processing WhatsApp messages.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• privacy_policy_unfetchable api Privacy policy URL is generic Google account page; fetch failed with SSLError; no extension scope.
• function_constructor_in_content_script crx new Function() found in content script scoped to web.whatsapp.com — dynamic code execution risk.
• dom_xss_sink_no_csp crx innerHTML from variable in content script; csp_present=false amplifies DOM-XSS risk.
• broad_external_hosts crx 12 external JS hosts including generativelanguage.googleapis.com, socket.io, github.com, multiple Google services.
• no_verified_publisher store verified_publisher=false, is_featured_by_google=false; developer 'Intzp' at .store TLD domain.
• very_low_install_count store Only 7 installs; no ratings; minimal community validation for an extension with broad WhatsApp access.
• ai_api_contact crx generativelanguage.googleapis.com in js_external_hosts — extension may send WhatsApp message content to Gemini AI.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WANQUEST - CONECTE, AUTOMATIZE E CRESÇA [adware] + malext.io malicious_extension_sentry; score 4.57 -> 7.07 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low risk on its own.
• storage low Standard local storage API; low risk.
• alarms low Scheduling alarms; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk for CRM context.
• https://web.whatsapp.com/* medium Host permission scoped only to WhatsApp Web; content injection into messaging platform.

Pillar Scores

Bookkeeping