Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension; data collection and 3rd-party sharing admitted without extension-specific disclosure.
• Brand impersonation: WhatsApp brand used by unverified dev 'ewdht' at extensao.store with no confirmed ownership.
• Uninstall URL hijack and install URL hijack both flagged — likely telemetry/redirect abuse on lifecycle events.
• 10+ external wascript.com.br/watools.com.br backend hosts contacted; broad backend surface with no CSP on MV3.
• function_constructor (new Function) in content script running on WhatsApp Web enables dynamic code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed WhatsApp owner.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• multiple_external_backends crx 10 distinct wascript.com.br and watools.com.br endpoints in js_external_hosts; high backend surface area.
• function_constructor crx new Function() found in content script file v_7_4_3_80_...193.js — dynamic code execution capability.
• no_csp manifest csp_present=false on MV3 extension with 334 JS files and external backend communication.
• developer_identity_weak store Developer name 'ewdht' is opaque; not verified publisher, not featured; email domain extensao.store is generic.
• dom_xss_sink crx innerHTML assigned from variable in content script running inside WhatsApp Web — DOM-XSS risk on message data.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard key-value storage for extension state.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles across the browser session.
• https://web.whatsapp.com/* (host_permission) medium Grants full content access to WhatsApp Web, including messages and contacts.

Pillar Scores

Bookkeeping