Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0 privacy).
• Uninstall URL hijack flagged; install redirect to web.whatsapp.com; classic monetization/tracking shell signals.
• 10+ external wascript.com.br / watools.com.br hosts contacted without CSP — remote-code-loading surface is large.
• WhatsApp brand impersonation confirmed (is_impersonation=true) by unverified developer 'wsll' on extensao.store domain.
• function_constructor + innerHTML sink without CSP raises DOM-XSS / code-injection risk inside WhatsApp Web session.

Evidence

• uninstall_url_hijack manifest uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com — monetization shell pattern.
• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• external_hosts_broad crx 10 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP to constrain them.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk (+2.5 code quality).
• dom_sink_innerhtml crx innerHTML user-controlled sink without CSP present — DOM-XSS risk amplified (+2.0 code quality).
• no_csp manifest content_security_policy=null on MV3 extension with remote JS hosts; no mitigation for injection risks.
• developer_identity_weak store Developer 'wsll'; email contato@extensao.store; not verified publisher, not featured; only 49 installs.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm alone.
• storage low Standard local key-value storage; low risk.
• alarms low Scheduled background tasks; low risk in isolation.
• tabs medium Can read tab URLs and titles across sessions; moderate risk.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; content scripts run there, enabling message interception.

Pillar Scores

Bookkeeping