Top Risks

• Uninstall URL hijack active: extension redirects on uninstall to track/monetize uninstalls.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: dev does not own WhatsApp; confirmed_owner=false.
• Content script on WhatsApp Web can read all chat messages; 10 external wascript.com.br endpoints contacted.
• function_constructor (new Function) + innerHTML DOM-XSS sink in injected scripts with no CSP.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; uninstall_url_target=null but hijack confirmed true.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — 3rd-party redirect on install.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy store Privacy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts_volume crx 10 distinct wascript.com.br subdomains plus generativelanguage.googleapis.com and mail.google.com contacted.
• code_quality_function_constructor crx new Function() constructor found in injected content script — arbitrary code execution risk.
• no_csp manifest content_security_policy is null; MV3 default applies but csp_present=false increases DOM-sink risk.
• reputation_no_verified_publisher store Developer 'wspd' email at extensao.store; not verified, not featured, no recognised org.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard local key-value storage; low risk in isolation.
• alarms low Scheduled tasks; minimal risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• content_scripts: https://web.whatsapp.com/* medium Injects code into WhatsApp Web; can read/modify all messages and UI.

Pillar Scores

Bookkeeping