Top Risks

• Operator cluster of 23 sibling extensions under same dev email — mass deployment / farm pattern.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; install redirects to WhatsApp Web on behalf of user.
• WhatsApp brand impersonation by unverified developer on extensao.store domain.
• function_constructor (new Function) used in 4 files with no CSP — dynamic code execution risk on WhatsApp DOM.

Evidence

• operator_cluster_sibling_count_23 api 23 sibling extensions share same dev email, install URL, and CSP host set — strong farm fingerprint.
• uninstall_url_hijack_and_install_url_hijack crx Both uninstall and install URL hijacks present; install redirects to https://web.whatsapp.com.
• brand_impersonation_whatsapp store Extension mentions WhatsApp brand; developer domain extensao.store is not a confirmed WhatsApp owner.
• privacy_policy_generic_google store Policy URL is Google Account privacy page — not scoped to this extension; data_collection=true, third_party_sharing=true.
• function_constructor_no_csp crx 4 new Function() calls across multiple JS files; csp_present=false amplifies DOM code-execution risk.
• js_external_hosts_10_domains crx 10 distinct external wascript.com.br / watools.com.br endpoints contacted — broad backend surface.
• dom_sink_innerhtml_no_csp crx innerHTML user-controlled sink present with csp_present=false — DOM-XSS elevated risk.
• host_perm_whatsapp_web manifest Full content-script access to https://web.whatsapp.com/* — can read all WhatsApp Web messages.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local data storage; low risk in isolation.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• host_permissions: https://web.whatsapp.com/* medium Full access to WhatsApp Web DOM; can read messages and user data.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping