Top Risks

• WhatsApp brand impersonation by unverified developer with no confirmed ownership.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack flags set; installs open web.whatsapp.com.
• 10+ distinct external backend hosts (wascript.com.br, watools.com.br) contacted — large exfil surface on WhatsApp session.
• function_constructor and unscoped innerHTML sink present in 334 JS files with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_backends crx 10 external wascript.com.br/watools.com.br hosts in js_external_hosts — broad backend reach on WhatsApp data.
• function_constructor crx new Function() found in v_7_4_3_80_...193.js — dynamic code execution risk.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension with dynamic code findings.
• unverified_developer store verified_publisher=false, is_featured_by_google=false, dev name 'wspd' with no recognized org.
• low_install_new_extension store Only 29 installs; no ratings; high backend surface area creates disproportionate risk vs. user base.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local caching.
• storage low Standard local key-value storage, low risk.
• alarms low Scheduling API; low risk in isolation.
• tabs medium Can read tab URLs and titles; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host permission; allows full page access and script injection on WhatsApp Web.

Pillar Scores

Bookkeeping