Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (Privacy=10.0).
• Brand impersonation: extension is not affiliated with WhatsApp or Google despite prominently using both brands.
• Uninstall and install URL hijacks detected; install redirects user to web.whatsapp.com, uninstall URL set to third party.
• 10+ distinct external wascript.com.br backend hosts contacted from WhatsApp content-script — high data-exfil surface.
• function_constructor (new Function) and unguarded innerHTML in WhatsApp context create XSS and code-injection risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; brands whatsapp+google mentioned; developer not confirmed owner of either.
• generic_privacy_policy store PP URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com on install.
• external_hosts crx 10 distinct wascript.com.br subdomains plus watools.com.br contacted; broad backend surface for WhatsApp data.
• function_constructor crx new Function() constructor found in content JS; enables dynamic code execution inside WhatsApp page context.
• dom_sink_innerhtml crx innerHTML assigned from variable in WhatsApp content-script; DOM-XSS sink with no CSP protection.
• no_csp manifest content_security_policy=null; csp_present=false. MV3 default applies but no explicit CSP restricts script-src.
• low_install_unverified_dev store Only 6 installs; not verified publisher; dev name 'wsll' with no recognizable business identity.

Permissions Breakdown

• tabs medium Can read tab URLs and metadata across sessions; moderate privacy risk.
• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard local key-value storage, minimal risk alone.
• alarms low Scheduling API; low risk, used for periodic tasks.
• https://web.whatsapp.com/* high Full content-script access to WhatsApp Web; can read all messages, contacts, and DOM.

Pillar Scores

Bookkeeping