Top Risks

• Uninstall AND install URL hijacks detected — classic monetization/tracking shell pattern.
• Privacy policy is Google's own policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain extensao.store is not Meta/WhatsApp.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted — broad backend surface with no CSP.
• function_constructor (new Function) + uncontrolled innerHTML with no CSP raises DOM-XSS and code-injection risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set — triggers Webstore +3.0 penalty for monetization shell.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack detected (+2.0 Webstore).
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not Meta-owned.
• privacy_policy_generic store Policy URL is Google's global privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• js_external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; no CSP to constrain them.
• no_csp manifest content_security_policy is null (MV3, no explicit CSP); combined with code findings elevates code quality risk.
• function_constructor crx new Function() used in JS bundle — dynamic code execution risk, +2.5 Code Quality.
• unverified_developer store Developer 'wsll', email contato@extensao.store, no verified publisher badge, no featured badge.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm but enables local data hoarding.
• storage low Standard key-value store; low risk in isolation.
• alarms low Scheduled tasks; low risk, can be used for persistent background activity.
• tabs medium Can read tab URLs and titles across browser; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host permission scoped only to WhatsApp Web; matched to stated CRM function.

Pillar Scores

Bookkeeping