Top Risks

• Uninstall + install URL hijack: both hooks set, redirecting users to third-party on lifecycle events.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 privacy).
• WhatsApp brand impersonation: confirmed_owner=false, not verified publisher, directly references WhatsApp in name/function.
• 10+ external JS hosts (wascript.com.br, watools.com.br) expanding attack surface beyond stated single-domain function.
• function_constructor usage combined with no CSP and innerHTML sink raises DOM-XSS and code-injection risk.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall URL hooks present; classic monetization/redirect shell pattern.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints contacted; broad external backend surface.
• function_constructor crx new Function() found in bundled JS; dynamic code execution risk, no CSP to mitigate.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in content script running on WhatsApp Web; DOM-XSS sink with no CSP.
• unverified_developer store Developer name 'wty', email contato@extensao.store; not verified publisher, not featured.
• no_csp manifest content_security_policy is null; MV3 has strict default but external host calls still raise injection risk.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm.
• storage low Standard key-value storage, low risk.
• alarms low Scheduled tasks; low risk on its own.
• tabs medium Can read tab URLs/titles across all open tabs.
• https://web.whatsapp.com/* medium Host-scoped access; limited to WhatsApp Web but all messages visible.

Pillar Scores

Bookkeeping