Top Risks

• Uninstall AND install URL hijack: redirects users to WhatsApp Web on install/uninstall — classic traffic manipulation.
• WhatsApp brand impersonation by unverified developer 'ewdht' at throwaway-named domain extensao.store.
• Privacy policy is Google's own policy, not scoped to this extension — effectively no disclosure of data collection.
• 10 external JS hosts under wascript.com.br/watools.com.br contacted at runtime — large unaudited backend surface.
• function_constructor + innerHTML DOM-XSS sink in content script running inside WhatsApp Web session.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstalled and uninstall URL hooks active; install target is https://web.whatsapp.com (traffic redirect).
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is not confirmed owner of brand.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — scope_extension=false, data_collection=true, third_party=true.
• 10 external JS hosts crx Hosts include api-whatsapp, backend-plugin, code.wascript.com.br etc — remote code/API dependency cluster.
• function_constructor crx new Function() in content script executed inside WhatsApp Web DOM — arbitrary code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML set from variable in WhatsApp Web content script — DOM-XSS sink without CSP protection.
• no_csp manifest content_security_policy is null on MV3 extension with external JS hosts and DOM sinks.
• low_install_unverified_dev store Only 55 installs, no verified publisher badge, developer name 'ewdht' with no web presence.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables data hoarding.
• storage low Standard local key-value storage, minimal risk.
• alarms low Scheduled tasks; low risk alone.
• tabs medium Can read tab URLs and titles across all open tabs.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; content scripts can read all messages.

Pillar Scores

Bookkeeping