Top Risks

• Uninstall URL hijack detected — sets third-party URL on removal, classic monetization shell signal.
• Install URL hijack opens web.whatsapp.com on install — onInstalled redirect pattern.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: confirmed_owner=false, not verified publisher.
• 10+ external JS hosts (wascript.com.br, watools.com.br) contacted with no CSP; broad outbound surface with no content security policy.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() to third-party target — +3.0 Webstore per rubric.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — +2.0 Webstore per rubric.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not confirmed owner.
• generic_privacy_policy store Policy is Google's own myaccount policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• no_csp manifest csp_present=false on MV3 extension with external JS hosts; dom_sink + function_constructor findings elevate code risk.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains as JS hosts with no CSP — broad outbound surface.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk (+2.5 Code Quality).
• dom_sink_innerhtml crx innerHTML from variable with no CSP present — DOM-XSS sink elevated to +2.0 per FIX B.

Permissions Breakdown

• unlimitedStorage low Local storage quota removal; no cross-origin data access.
• storage low Standard local/sync storage; low standalone risk.
• alarms low Scheduling only; no sensitive data access.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function.

Pillar Scores

Bookkeeping