Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension; data collection and 3rd-party sharing admitted.
• Uninstall and install URL hijacks detected; install redirect opens web.whatsapp.com (benign target but pattern is abusive).
• Content script on web.whatsapp.com can read all WhatsApp messages/contacts; 10+ external backend hosts contacted.
• WhatsApp brand impersonation: developer is not a confirmed WhatsApp/Meta owner.
• No CSP on MV3 extension with new Function() usage and multiple wascript.com.br / watidy.com backend endpoints.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; uninstall_url_target is null but flag is true — webstore anomaly.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — third-party URL redirect on install.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-specific; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain worksystemas.com.br is not Meta/WhatsApp.
• external_hosts_count crx 12 external JS hosts including api-whatsapp.wascript.com.br, multi-atendimento.wascript.com.br, painel.waclientes.com.br, domselector.watidy.com.
• function_constructor crx new Function() usage detected in bundled JS; no CSP present to mitigate dynamic code execution.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension with dynamic code and multiple remote backends.
• whatsapp_content_script manifest Content script injected into https://web.whatsapp.com/* — full access to WhatsApp Web DOM including messages and contacts.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard key-value storage for extension state.
• alarms low Scheduled tasks; minimal risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/manipulate all messages and contacts shown.

Pillar Scores

Bookkeeping