Top Risks

• Uninstall URL hijack detected — extension redirects user on uninstall to 3rd-party URL (Webstore +3.0).
• Install URL hijack detected — extension opens external URL on install (Webstore +2.0).
• Privacy policy is Google's own generic policy; does not scope to this extension at all (Privacy +10.0).
• WhatsApp brand impersonation: brand_mention.is_impersonation==true, developer is not confirmed owner (Reputation +2.0).
• 10 external JS hosts contacted (wascript.com.br, watools.com.br, etc.) — broad backend surface on WhatsApp data (Network).

Evidence

• uninstall_url_hijack manifest uninstall_url_hijack=true; extension registers 3rd-party uninstall redirect — monetization/tracking signal.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com — opens external page on install.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true — worst case.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br hosts contacted; extension runs inside WhatsApp Web with full message access.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk (+2.5 code quality).
• dom_xss_sink crx innerHTML assigned from variable with no CSP; DOM-XSS risk elevated by csp_present=false (+2.0 code quality).
• no_csp manifest content_security_policy=null on MV3 extension with external hosts and DOM-sink findings.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low direct exfil risk but enables data hoarding.
• storage low Standard local key-value storage; minimal risk on its own.
• alarms low Schedules background tasks; can trigger periodic beaconing.
• tabs medium Can read tab URLs and titles; moderate privacy exposure across browsing.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web; enables full content-script access to messages.

Pillar Scores

Bookkeeping