Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — App Vendas CRM [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — completely unscoped to this extension, admits data collection and 3rd-party sharing.
• Uninstall URL hijack and install redirect to web.whatsapp.com flagged; classic traffic-manipulation pattern.
• 10 external wascript.com.br / watools.com.br hosts contacted with no CSP; remote code-loading surface on WhatsApp Web.
• Brand impersonation: 'google' mentioned in listing by unverified developer who points to Google's privacy policy.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall URL hijacks present; install redirects to https://web.whatsapp.com.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not verified and does not own google.com.
• external_hosts_no_csp crx 10 distinct external wascript.com.br / watools.com.br hosts in js_external_hosts; csp_present=false.
• function_constructor crx new Function() constructor found — dynamic code execution capability, +2.5 to code quality.
• dom_sink_innerhtml_no_csp crx innerHTML sink with csp_present=false triggers +2.0 escalated code quality penalty.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true → D-clause: +10.0 privacy pillar.
• reputation_no_verified_publisher store Developer 'Stfl' at extensao.store; not verified, not featured, impersonates Google brand.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — App Vendas CRM [adware] + malext.io malicious_extension_sentry; score 5.84 -> 8.34 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct risk but enables large local data caching.
• storage low Standard local/sync storage; minimal risk alone.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; matches stated function but enables full page interception.

Pillar Scores

Bookkeeping