Top Risks

• WhatsApp brand impersonation by unverified dev 'ewdht' at extensao.store — confirmed is_impersonation=true.
• Uninstall+install URL hijack both set; install hijack sends user to web.whatsapp.com on every install.
• Privacy policy is Google's own generic policy (scope_extension=false, data_collection=true, third_party_sharing=true) — worst case per rubric.
• 10 distinct external wascript.com.br / watools.com.br backend hosts contacted at runtime; high exfil surface for WhatsApp data.
• function_constructor (new Function) + innerHTML DOM-XSS sink found in 334-file JS bundle with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands=['whatsapp']; dev domain extensao.store not confirmed owner.
• url_hijack manifest uninstall_url_hijack=true, install_url_hijack=true targeting https://web.whatsapp.com on install.
• generic_privacy_policy store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; runs against WhatsApp Web sessions.
• function_constructor crx new Function() constructor found in JS bundle; dynamic code execution risk without CSP guard.
• no_csp manifest content_security_policy is null/csp_present=false; dom_sink_innerhtml + function_constructor amplified.
• unverified_developer store Developer 'ewdht', email contato@extensao.store; not verified publisher, not featured; 27 installs.
• webstore_install_hijack_pattern store install_url_hijack=true scored +2.0 webstore; uninstall_url_hijack=true scored +3.0 webstore.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling only; low risk.
• tabs medium Can read tab URLs and titles; moderate risk when paired with WhatsApp host access.
• https://web.whatsapp.com/* medium Grants content script and host access to WhatsApp Web — can read messages and contacts.

Pillar Scores

Bookkeeping