Top Risks

• Uninstall URL hijack detected: extension intercepts uninstall event to redirect users.
• Privacy policy is Google's own policy (not extension-scoped) yet admits data collection & 3rd-party sharing — critical mismatch.
• WhatsApp brand impersonation: confirmed_owner=false, is_impersonation=true; developer domain unrelated to Meta.
• 10 external wascript.com.br / watools.com.br endpoints contacted without CSP; broad network surface on messaging data.
• function_constructor (new Function) in content script running against WhatsApp Web DOM.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL hijack flagged; target null but hook present — Webstore +3.0.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — install URL hijack flagged +2.0.
• brand_impersonation store brand_mention WhatsApp, confirmed_owner=false, is_impersonation=true; dev domain extensao.store.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection+3rd_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; no CSP — broad outbound from WhatsApp session.
• function_constructor crx new Function() in content script; +2.5 code quality risk per rubric.
• dom_sink_innerhtml_userctrl crx innerHTML from variable without CSP present — elevated DOM-XSS risk, scores +2.0 under FIX B.
• reputation_no_verified_publisher store Developer 'wty', no verified publisher badge, no featured badge; reputation baseline elevated.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk in isolation.
• storage low Standard local data persistence, no cross-origin access.
• alarms low Scheduling alarms; no direct data access risk.
• tabs medium Can read tab URLs and titles; mild privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; reads/modifies WhatsApp DOM and data.

Pillar Scores

Bookkeeping