Top Risks

• Uninstall URL hijack + install URL hijack signal aggressive monetization/tracking behavior.
• Privacy policy is Google's generic policy — does NOT cover this extension; scores 10.0.
• WhatsApp brand impersonation by unverified developer 'wty' at extensao.store.
• 10 external JS hosts (wascript.com.br, watools.com.br) with no CSP — remote code execution surface.
• function_constructor + innerHTML sink in content script running on WhatsApp Web DOM.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both install and uninstall URL hijacks present; aggressive monetization/tracking pattern.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to CRMSIM.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true; developer domain extensao.store not affiliated with Meta/WhatsApp.
• 10_external_js_hosts_no_csp crx 11 external host entries including 8 wascript.com.br subdomains; csp_present=false.
• function_constructor crx new Function() constructor found in content script — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script with no CSP — DOM-XSS risk on WhatsApp Web.
• developer_identity_weak store Developer name 'wty', email contato@extensao.store; not verified publisher, no featured badge.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → D clause: +10.0 privacy.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large data hoarding.
• storage low Standard local key-value storage; minimal risk.
• alarms low Background scheduling; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* (host) medium Full access to WhatsApp Web DOM — can read messages, contacts, and inject content.

Pillar Scores

Bookkeeping