Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — EAI + [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack detected; install URL hijack redirects to WhatsApp Web on install.
• WhatsApp brand impersonation: dev domain 'extensao.store' is not affiliated with Meta/WhatsApp.
• 10+ distinct external wascript.com.br/watools.com.br endpoints contacted; no CSP in MV3 extension with 334 JS files.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; install_url_hijack also true — opens https://web.whatsapp.com on install.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's own privacy policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains contacted; csp_present=false with 334 JS files.
• function_constructor crx new Function() constructor found in content script running on WhatsApp Web — capable of dynamic code execution.
• dom_sink_innerhtml_userctrl crx innerHTML set from variable in content script with no CSP; DOM-XSS risk on WhatsApp Web chat content.
• unverified_developer store No verified publisher badge; developer 'whscl' with email contato@extensao.store; not recognized org.
• geo_diversity_low api All JS hosts resolve to CA (1 country); no geo-diversity penalty applied.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — EAI + [adware] + malext.io malicious_extension_sentry; score 5.54 -> 8.04 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but can cache large data silently.
• storage low Standard extension storage; low risk.
• alarms low Periodic background tasks; low risk alone.
• tabs medium Can enumerate open tabs and URLs; moderate risk.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; high sensitivity (chat data) but narrow host scope.

Pillar Scores

Bookkeeping