Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Z Turbinado [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; install redirects user to web.whatsapp.com on install.
• WhatsApp brand impersonation: developer domain (extensao.store) is not affiliated with Meta/WhatsApp.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted — large exfiltration surface over WhatsApp session.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() to 3rd-party detected; install redirect to https://web.whatsapp.com on install.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta-owned.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 12 distinct external JS hosts, all under wascript.com.br/watools.com.br; large backend surface for WhatsApp data.
• function_constructor crx new Function() constructor found in content script JS; dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable without CSP — DOM-XSS sink in content script on WhatsApp Web.
• no_csp manifest content_security_policy is null (MV3 default applies, but no explicit restriction on connect-src or script-src).
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack confirmed.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Z Turbinado [adware] + malext.io malicious_extension_sentry; score 5.43 -> 7.93 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Local data only; low direct harm but enables large local caching.
• storage low Standard local/sync storage; low risk.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• host_permissions: https://web.whatsapp.com/* medium Full content access on WhatsApp Web; can read messages and inject code into chat sessions.

Pillar Scores

Bookkeeping