Top Risks

• Critical CVE in bundled underscore@1.8.3 (CVE-2021-23358: arbitrary code execution) running inside WhatsApp Web context.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (→ Privacy=10).
• WhatsApp brand impersonation: developer is not confirmed owner of WhatsApp; extension injects into web.whatsapp.com and could exfil messages.
• Uninstall URL hijack flagged; install redirect to web.whatsapp.com; 11 external JS hosts including tinyurl.com URL-shortener and n8nwebhook endpoint.
• DOM-XSS sink (innerHTML with user-controlled variable) in content script running on WhatsApp Web, amplified by CVE-vulnerable underscore lib.

Evidence

• cve_critical_underscore crx underscore@1.8.3 bundled; CVE-2021-23358 critical ACE, fixed in 1.12.1. Version not patched.
• privacy_policy_generic_google store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer not confirmed owner.
• uninstall_url_hijack manifest uninstall_url_hijack=true; install_url_hijack=true targeting web.whatsapp.com.
• external_js_hosts_broad crx 11 external JS hosts including tinyurl.com (URL shortener) and n8nwebhook.sistemazapplus.com.br.
• dom_xss_sink crx innerHTML user-controlled sink in PortalComponent-9e9615b2.js; CSP present but CVEs amplify risk.
• whatsapp_host_permission manifest host_permissions and content_scripts both target web.whatsapp.com/* — full message access.
• dev_backend_exfil_path manifest host_permissions include automacoes.drtsistemas.com.br/* — dev-controlled exfil endpoint.

CVE Exposures (2)

Permissions Breakdown

• tabs medium Can read tab URLs/titles; moderate risk in context of WhatsApp automation.
• storage low Local key-value storage; low risk on its own.
• unlimitedStorage low Removes storage quota; low risk but could cache large payloads.
• alarms low Scheduling API; low standalone risk.
• host:https://web.whatsapp.com/* high Full script/read/write access to WhatsApp Web; can harvest messages and contacts.
• host:https://automacoes.drtsistemas.com.br/* medium Dev-controlled backend; enables data exfil to dev's own server.

Pillar Scores

Bookkeeping