Top Risks

• Privacy policy is Google's own policy (not extension-scoped) — admits data collection & 3rd-party sharing with no extension context.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com (behavioral manipulation signal).
• Brand impersonation: mentions WhatsApp and Google; developer domain extensao.store is not affiliated.
• 334 JS files contacting 10 distinct wascript.com.br / watools.com.br external hosts — large opaque attack surface on WhatsApp session.
• function_constructor (new Function) + no CSP on MV3 extension running inside WhatsApp Web — code execution risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() hijack detected; install redirect to https://web.whatsapp.com.
• privacy_policy_generic store Policy URL is Google's own myaccount policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true; brands WhatsApp & Google mentioned; developer not confirmed owner.
• external_hosts_large crx 10 distinct wascript.com.br/watools.com.br subdomains contacted; extension runs on WhatsApp Web session.
• function_constructor crx new Function() constructor found in content script; no CSP defined.
• dom_xss_sink crx innerHTML assigned from variable in content script; csp_present=false amplifies risk.
• unverified_developer store verified_publisher=false, is_featured=false, 6 installs, no ratings; throwaway-profile characteristics.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — behavioral pattern consistent with session-hijacking tooling.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but can persist large data.
• storage low Standard key-value storage; limited risk alone.
• alarms low Scheduled callbacks; enables persistent background activity.
• tabs medium Can read tab URLs and titles across all tabs; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all messages visible in DOM.

Pillar Scores

Bookkeeping