Top Risks

• Privacy policy URL is unreachable (fetch error) — no data handling disclosure for an extension accessing WhatsApp Web.
• Uninstall and install URL hijack flags set — redirect manipulation at install/uninstall lifecycle.
• WhatsApp brand impersonation by unverified gmail developer — confirmed non-owner.
• Function constructor (new Function) and innerHTML DOM-XSS sink in content scripts injected into WhatsApp Web.
• Multiple external backend hosts (wascript.com.br, waclientes.com.br) contacted by WhatsApp content scripts — data exfil surface.

Evidence

• privacy_policy_unreachable api Privacy policy at http://www.zappmaster.online/privacy-policy returned HTTPError on fetch; no disclosure available.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers an uninstall URL redirect.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://web.whatsapp.com.
• brand_impersonation store WhatsApp brand mentioned; developer is gmail.com, confirmed_owner=false, is_impersonation=true.
• function_constructor crx new Function() constructor found in content script injected into WhatsApp Web DOM.
• dom_sink_innerhtml crx innerHTML assignment from variable in content script; DOM-XSS sink with no CSP present.
• external_hosts crx 8+ external hosts under wascript.com.br and waclientes.com.br contacted; broad backend surface for WA data.
• free_webmail_developer store Developer email is alrogattodev@gmail.com with no verified publisher status or business domain.

Permissions Breakdown

• storage low Local data persistence; low standalone risk.
• unlimitedStorage low Extended local storage; minor risk.
• alarms low Scheduling; low risk.
• tabs medium Can read tab URLs/titles across browser; moderate data exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify WA messages in DOM.

Pillar Scores

Bookkeeping