Top Risks

• Google privacy policy used as extension policy — admits data collection and 3rd-party sharing with no extension scope.
• Uninstall URL hijack and install URL hijack both flagged — classic monetization/tracking shell behavior.
• WhatsApp brand impersonation by unverified developer; confirmed_owner=false.
• 10 external JS hosts under wascript.com.br/watools.com.br — broad undisclosed network surface on WhatsApp content.
• function_constructor and innerHTML DOM-XSS sink in content script context with no CSP.

Evidence

• privacy_policy_generic_google store Privacy URL points to Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — v3.5(D) +10.0.
• install_uninstall_hijack manifest uninstall_url_hijack=true and install_url_hijack=true; install target is https://web.whatsapp.com.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints contacted; broad undisclosed backend surface.
• function_constructor crx new Function() constructor found in content script — dynamic code execution risk (+2.5).
• dom_sink_innerhtml_no_csp crx innerHTML from variable with csp_present=false triggers FIX B elevated scoring (+2.0).
• no_csp_mv3 manifest content_security_policy is null; MV3 default applies but no CSP declared amplifies code findings.
• unverified_low_install_developer store 33 installs, no verified publisher, dev email on .store TLD (extensao.store), developer name 'wsll' opaque.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; limited direct harm alone.
• storage low Standard local key-value storage, low risk.
• alarms low Scheduling API, low standalone risk.
• tabs medium Can read tab URLs and metadata; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify WhatsApp messages in browser.

Pillar Scores

Bookkeeping