Top Risks

• Uninstall URL hijack + install URL hijack indicate monetization/tracking behavior.
• Privacy policy is Google's generic policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• WhatsApp impersonation: brand_mention.is_impersonation=true, developer not verified owner.
• 10+ external JS hosts (wascript.com.br, watools.com.br) with no CSP — remote code execution surface.
• function_constructor (new Function) + innerHTML sink with no CSP raises code execution risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; Webstore +3.0 penalty applied.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com; Webstore +2.0 penalty applied.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true -> +10.0 privacy.
• brand_impersonation store brand_mention WhatsApp confirmed, confirmed_owner=false, is_impersonation=true; +2.0 reputation.
• no_csp manifest csp_present=false; amplifies code-quality risks and innerHTML/Function constructor findings.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br hosts; no CSP; broad outbound surface -> Network +1.5.
• function_constructor crx new Function() constructor detected in JS bundle; +2.5 code quality.
• developer_identity store Dev name 'wsll'; email contato@extensao.store; not verified publisher; no featured badge.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard local data persistence; low risk on its own.
• alarms low Background scheduling; low risk.
• tabs medium Can read tab URLs/titles; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Host permission scoped only to WhatsApp Web; grants content script + request access to messaging platform.

Pillar Scores

Bookkeeping