Top Risks

• Uninstall URL hijack + install URL hijack detected — classic monetization/redirect shell pattern.
• Privacy policy is Google's generic account policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer (ewdht / extensao.store) — confirmed non-owner.
• 10+ external wascript.com.br / watools.com.br endpoints contacted with no CSP; wide exfil surface on WhatsApp Web.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in content scripts running on WhatsApp Web.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both hijack flags true; install redirects to https://web.whatsapp.com — monetization/tracking shell pattern.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer (extensao.store) confirmed_owner=false.
• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints; no CSP; broad outbound surface on WhatsApp session.
• function_constructor crx new Function() found in content script — dynamic code execution risk on WhatsApp Web.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in content script without CSP — DOM-XSS risk on WhatsApp Web.
• developer_identity store Developer name 'ewdht' is opaque alias; no verified publisher badge; email domain extensao.store.
• host_permissions_whatsapp manifest Content scripts match https://web.whatsapp.com/* — full read/write access to all WhatsApp Web chat content.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large data caching.
• storage low Standard extension storage API; minimal risk.
• alarms low Schedule recurring tasks; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk when paired with WhatsApp host access.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; content scripts can read/modify all WhatsApp messages.

Pillar Scores

Bookkeeping