Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack flag set; extension hooks uninstall event to external target.
• Install URL hijack opens https://web.whatsapp.com on install — behavioral signal of onInstalled redirect.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no CSP — broad network surface on WhatsApp session data.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; chrome.runtime.setUninstallURL called to 3rd party → +3.0 webstore.
• install_url_hijack crx install_url_hijack=true, target=https://web.whatsapp.com → +2.0 webstore.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer not verified/featured → +2.0 reputation.
• no_csp_mv3 crx csp_present=false on MV3; dom_sink_innerhtml_userctrl finding escalated to +2.0 under FIX B.
• external_js_hosts crx 12 js_external_hosts including 8+ wascript.com.br subdomains; >3 distinct registrable domains → +1.5 network.
• function_constructor crx new Function() constructor detected in bundled JS → +2.5 code quality.
• reputation_no_verified_publisher store Not verified, not featured; developer email on .store TLD with elevated-risk pattern; base 5.0+2.0 impersonation.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables data hoarding.
• storage low Standard local key-value storage; low risk.
• alarms low Scheduled callbacks; minimal risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk when paired with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all WhatsApp session data.

Pillar Scores

Bookkeeping