Top Risks

• Brand impersonation: unverified Gmail dev using 'WhatsApp Plus' name, confirmed is_impersonation=true.
• Unknown backend backendsagrado.onrender.com + wup.plus in host_permissions with no disclosed purpose; potential WhatsApp data exfil.
• Privacy policy not scoped to this extension, data_collection=false but third_party_silence=true; inadequate disclosure.
• install_url_hijack=true: onInstalled opens 3rd-party URL — user redirected on install.
• 3 innerHTML DOM-XSS sinks active on WhatsApp Web with no CSP, enabling script injection into message context.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; dev is pedrosarkisverani@gmail.com, not Meta/WhatsApp; confirmed_owner=false.
• free_webmail_dev store Developer email is gmail.com; no verified publisher badge; no business website.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens 3rd-party URL — redirect on install confirmed.
• unknown_backend_hosts manifest host_permissions include backendsagrado.onrender.com and wup.plus — undisclosed third-party endpoints.
• dom_xss_sinks_no_csp crx 3 innerHTML sinks in drawflow.min.js, viewOnce.js, limitModal.js; csp_present=false amplifies risk.
• privacy_policy_inadequate api scope_extension=false, third_party_silence=true; policy hosted on free Render infra, not scoped to extension.
• external_hosts_diversity crx js_external_hosts includes buy.stripe.com, grandtibiaauto.com, sheetjs.com, youtube.com — 7 distinct hosts.
• geo_diversity api JS hosts span BR, CA, US (3 countries); below +1.5 threshold of 4.

Permissions Breakdown

• storage low Local data persistence only; low standalone risk.
• scripting medium Can inject scripts into host_permissions targets (whatsapp.com); elevated when scoped.
• alarms low Scheduling only; no data access.
• notifications low Can display notifications; low risk in isolation.
• https://web.whatsapp.com/* medium Full access to WhatsApp Web including messages and contacts.
• https://*.cdn.whatsapp.net/* low WhatsApp media CDN; limited risk scoped to media delivery.
• https://backendsagrado.onrender.com/* high Unknown third-party backend; data from WhatsApp context could be exfiltrated here.
• https://wup.plus/* high Unknown domain with no disclosed purpose; potential data sink outside stated function.

Pillar Scores

Bookkeeping