Top Risks

• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Brand impersonation: extension is WhatsApp-focused but developer domain is unrelated; confirmed not owner.
• Uninstall URL hijack and install URL hijack both flagged — classic monetization/tracking pattern.
• 12 external JS hosts including multiple wascript.com.br and watools.com.br Brazilian third-party backends.
• function_constructor and innerHTML DOM-XSS sink found in code; no CSP configured (MV3 but csp_present=false).

Evidence

• privacy_policy_generic store Policy URL is Google's global policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• brand_impersonation store brand_mention: WhatsApp mentioned, confirmed_owner=false, is_impersonation=true; not verified/featured → +2.0 Reputation.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting web.whatsapp.com → +3.0+2.0 Webstore.
• external_js_hosts crx 12 distinct external hosts: wascript.com.br (4 subdomains), watools.com.br, miquecrm.com, socket.io, react.dev, Google AI.
• code_function_constructor crx new Function() constructor found in JS file v_7_4_3_79_...193.js — dynamic code execution risk.
• code_innerhtml_sink crx innerHTML assignment from variable in v_7_4_3_79_...12.js; csp_present=false elevates DOM-XSS risk.
• no_developer_name store developer_name is empty string; verified_publisher=true but no display name surfaced.
• no_csp manifest content_security_policy=null; csp_present=false despite 334 JS files and multiple external backend calls.

Permissions Breakdown

• unlimitedStorage low Local storage quota expansion; no data exfil risk alone.
• storage low Standard key-value local/sync storage; minimal risk.
• alarms low Scheduled tasks; low risk in isolation.
• tabs medium Can enumerate open tabs; moderate privacy concern.
• https://web.whatsapp.com/* high Full access to WhatsApp Web — can read messages, contacts, media.

Pillar Scores

Bookkeeping