Top Risks

• Uninstall URL hijack active; install URL hijack redirects to web.whatsapp.com — monetization/tracking shell pattern.
• Privacy policy is Google's own policy (not scoped to this extension); admits data collection and 3rd-party sharing — scores max privacy risk.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10+ external JS hosts (wascript.com.br, watools.com.br) contacted at runtime with no CSP; broad exfil surface over WhatsApp chat data.
• function_constructor and innerHTML DOM-XSS sink found in content scripts running on WhatsApp Web; no CSP to mitigate.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; uninstall_url_hijack=true. Webstore +3.0.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com; install_url_hijack=true. Webstore +2.0.
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — not scoped to extension; data_collection+third_party_sharing=true. Privacy +10.0.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer not confirmed owner. Reputation +2.0.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; no CSP. Network risk elevated.
• no_csp manifest content_security_policy=null on MV3; amplifies code-quality findings.
• function_constructor crx new Function() in content script — dynamic code execution risk. Code +2.5.
• dom_sink_innerhtml_userctrl crx innerHTML from variable with no CSP present — DOM-XSS sink elevated. Code +2.0.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low standalone risk.
• storage low Standard key-value storage; minimal risk.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles across sessions; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web only; enables content script injection into chat.

Pillar Scores

Bookkeeping