Top Risks

• Uninstall URL hijack and install URL hijack both present — classic monetization/tracking shell behaviour.
• Privacy policy is Google's generic policy (not scoped to this extension) yet admits data collection and 3rd-party sharing — worst-case privacy disclosure.
• WhatsApp brand impersonation by unverified developer (developer domain: extensao.store, confirmed_owner: false).
• 10 distinct wascript.com.br/watools.com.br external JS hosts contacted from a 334-file bundle — large attack surface.
• function_constructor (new Function) + innerHTML sink in content script running on WhatsApp Web without CSP.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both uninstall and install URL hijacks set; classic monetization shell pattern (+3.0 + +2.0 webstore).
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, not verified/featured → +2.0 reputation.
• 10_external_wascript_hosts crx js_external_hosts contains 10 wascript.com.br/watools.com.br endpoints; no CSP → high network surface.
• function_constructor crx new Function() in content script on WhatsApp Web DOM → +2.5 code quality.
• dom_sink_innerhtml_no_csp crx innerHTML sink + csp_present=false → +2.0 code quality (FIX B).
• no_csp_mv3 manifest content_security_policy=null; MV3 default applies but no explicit restriction on 334 JS files.
• developer_ewdht_no_verification store Developer name 'ewdht' is opaque, no verified publisher badge, no featured badge.

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct risk.
• storage low Standard local/sync storage for extension state.
• alarms low Scheduling; minimal risk alone.
• tabs medium Can read tab URLs/titles; moderate privacy risk.
• host_permission: https://web.whatsapp.com/* medium Full access to WhatsApp Web DOM, messages, and contacts.

Pillar Scores

Bookkeeping