Top Risks

• Uninstall URL hijack + install URL hijack flagged; classic monetization/tracking shell behavior.
• Privacy policy points to Google's own policy (not scoped to this extension); admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain (extensao.store) is not affiliated with Meta/WhatsApp.
• 10 external JS hosts under wascript.com.br/watools.com.br contacted; large unverified backend surface on WhatsApp session.
• function_constructor (new Function) and uncontrolled innerHTML in 334-file JS bundle without CSP protection.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and uninstall URL hooks set; install redirects to https://web.whatsapp.com — tracking/monetization pattern.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, admits data collection+3rd-party sharing.
• large_external_host_surface crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; extension contacts unverified third-party backends.
• function_constructor crx new Function() constructor found in bundle — dynamic code execution risk without CSP guard.
• dom_sink_innerhtml_userctrl crx Uncontrolled innerHTML assignment in JS bundle; no CSP present, elevating DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit policy); amplifies code quality risks.
• very_low_install_count store Only 5 installs; combined with URL hijacks and large backend surface suggests early-stage or targeted deployment.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data accumulation.
• storage low Standard key-value storage; low risk on its own.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles; medium risk when combined with host access.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; enables reading/writing WhatsApp session data.

Pillar Scores

Bookkeeping