Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Primeira Classe [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack detected — extension intercepts uninstall to redirect user, classic monetization/tracking shell pattern.
• Install URL hijack opens web.whatsapp.com on install — onInstalled redirect to 3rd-party URL pattern.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without extension scope.
• WhatsApp brand impersonation: developer domain does not belong to Meta/WhatsApp; extension is unverified.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target null but hijack flag true — monetization shell signal (+3.0 Webstore).
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install redirect pattern (+2.0 Webstore).
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner (+2.0 Reputation).
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy pillar (v3.5 D).
• external_js_hosts crx 10 distinct external hosts (wascript.com.br, watools.com.br subdomains) contacted by extension running on WhatsApp Web.
• function_constructor crx new Function() constructor found in scanned JS — code quality penalty +2.5.
• dom_sink_innerhtml_userctrl crx innerHTML from variable, no CSP present — elevated DOM-XSS risk (+2.0 code quality, FIX B).
• no_csp manifest content_security_policy is null/absent on MV3 extension with external hosts and code findings.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Primeira Classe [adware] + malext.io malicious_extension_sentry; score 5.23 -> 7.73 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Local data storage; low direct harm but enables large local caching.
• storage low Standard key-value local storage; low risk in isolation.
• alarms low Schedule background tasks; low risk alone.
• tabs medium Can read tab URLs and titles; moderate risk when combined with host access.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; allows content injection and data read on chat sessions.

Pillar Scores

Bookkeeping