Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks redirect to etivi.com/ai — behavioural monetisation signal.
• WhatsApp impersonation: brand_mention.is_impersonation=true; developer is not a confirmed WhatsApp owner.
• 10+ distinct external JS hosts including multiple wascript.com.br subdomains; broad outbound surface on sensitive WhatsApp data.
• function_constructor + unscoped innerHTML in content script running on WhatsApp Web — code-execution risk.

Evidence

• privacy_policy_google_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_install_url_hijack manifest Both onInstalled and onUninstalled redirect to https://etivi.com/ai — webstore monetisation pattern.
• whatsapp_brand_impersonation store brand_mention.is_impersonation=true; confirmed_owner=false; extension targets WhatsApp data without Meta affiliation.
• external_host_sprawl crx 12 external JS hosts including 6 wascript.com.br subdomains; data exfiltration surface on WhatsApp Web.
• function_constructor_code crx new Function() constructor found in content script — dynamic code execution risk in WhatsApp context.
• dom_xss_sink crx innerHTML assigned from variable in content script; no CSP present — DOM-XSS risk amplified.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on script sources.
• verified_publisher_but_generic_policy store verified_publisher=true but privacy policy is Google's generic page; invariant 0c cap applies — discount capped at -1.0.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct risk but can cache large data payloads.
• storage low Standard local key-value store; low risk.
• alarms low Schedules background tasks; low risk on its own.
• tabs medium Can read tab URLs and titles; medium risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* high Full access to WhatsApp Web content — reads/injects into all messages and contacts.
• https://app.guampe.com/* medium Access to third-party backend; data may be relayed there.

Pillar Scores

Bookkeeping