Top Risks

• Uninstall & install URL hijack: extension redirects lifecycle events to 3rd-party domain (wascript.com.br).
• WhatsApp impersonation brand: confirmed non-owner using WhatsApp branding without verification.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection & 3rd-party sharing.
• 10+ external JS hosts (wascript.com.br cluster) contacted from WhatsApp Web session — high exfil surface.
• new Function() constructor present with no CSP; DOM-XSS innerHTML sink; no content security policy set.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled and uninstall hooks redirect to external URLs; classic monetization/tracking shell pattern.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not affiliated.
• generic_privacy_policy store Policy URL is Google's own account policy (scope_extension=false, data_collection=true, third_party_sharing=true).
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted from WhatsApp Web content context.
• function_constructor crx new Function() in content JS with no CSP — arbitrary code execution risk within WhatsApp Web.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable with no CSP; DOM-XSS risk against WhatsApp Web content.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src or script-src.
• unverified_low_install_developer store 5 installs, no rating, no verified publisher badge, developer 'Intzp' with extensao.store email.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct risk but enables large local data accumulation.
• storage low Standard local storage access, minimal risk.
• alarms low Scheduled task execution; low risk alone.
• tabs medium Can read tab URLs and titles across sessions; moderate info-disclosure risk.
• https://web.whatsapp.com/* high Full content-script access to WhatsApp Web — can read/intercept messages and DOM.

Pillar Scores

Bookkeeping