Top Risks

• Uninstall URL hijack declared — extension registers an uninstall redirect to a third-party target.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without extension scope.
• Install URL hijack: onInstalled opens https://web.whatsapp.com, a third-party URL.
• WhatsApp brand impersonation: developer is not a confirmed WhatsApp owner but leverages the brand throughout.
• 12 external JS hosts contacted across wascript.com.br subdomains and other third parties — broad backend surface for a 34-install CRM.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to third-party target — classic monetization/tracking shell pattern.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — third-party URL redirect on install.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not confirmed as Meta/WhatsApp owner.
• external_hosts_broad crx 12 external JS hosts: 8x wascript.com.br subdomains + t.17track.net + www.linkcorreios.com.br + web.whatsapp.com.
• no_csp crx content_security_policy is null (csp_present=false) on MV3 extension with multiple external hosts.
• unverified_publisher store verified_publisher=false, is_featured_by_google=false; developer 'Intzp' at extensao.store with no brand trust signals.
• low_installs_whatsapp_crm store Only 34 installs for a CRM claiming WhatsApp Web integration with 8 backend subdomains — disproportionate backend surface.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low standalone risk.
• storage low Standard local data persistence; low risk.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read chat content and DOM data.

Pillar Scores

Bookkeeping