Top Risks

• Uninstall AND install URL hijack: onInstalled opens WhatsApp and uninstall URL intercepted (+6.0 webstore).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0 privacy).
• Brand impersonation: uses Google branding but developer is unverified extensao.store (+2.0 reputation).
• 10 external wascript.com.br / watools.com.br backend hosts with no CSP — remote code loading risk.
• function_constructor (new Function) in content script running on WhatsApp Web — arbitrary code execution risk.

Evidence

• install_url_hijack crx onInstalled redirects to https://web.whatsapp.com — install URL hijack confirmed.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but hijack flag set by scanner.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped.
• brand_impersonation store brand_mention: google mentioned, confirmed_owner=false, is_impersonation=true.
• external_hosts_10 crx 10 wascript.com.br/watools.com.br hosts in js_external_hosts; no CSP to restrict them.
• function_constructor crx new Function() used in content script on WhatsApp Web — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable in content script — DOM-XSS risk on WhatsApp Web.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on script-src.

Permissions Breakdown

• unlimitedStorage low Local storage quota expansion; low direct harm potential.
• storage low Standard key-value local storage access.
• alarms low Scheduling background tasks; low risk on its own.
• tabs medium Can read tab URLs/titles across browser; moderate privacy surface.
• https://web.whatsapp.com/* medium Full host access to WhatsApp Web — can read/modify all messages and contacts.

Pillar Scores

Bookkeeping