Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — waTidy : CRM no whatsapp, Automações e Ferramentas para venda [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension), admits data collection and 3rd-party sharing — privacy pillar maxes at 10.
• Operator cluster of 8 sibling extensions under same developer fingerprint signals a mass-deployment monetization operation.
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com obscuring true onboarding flow.
• WhatsApp brand impersonation: brand_mention.is_impersonation=true, developer is not a verified Meta/WhatsApp partner.

Evidence

• operator_cluster_siblings api 8 sibling extensions share same dev email, install URL, and JS host fingerprint — mass deployment pattern.
• privacy_policy_generic store Privacy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true; install redirects to https://web.whatsapp.com.
• no_developer_name store developer_name is empty string; verified_publisher=true but no display name provided.
• function_constructor crx new Function() call in JS file v_7_4_3_80_...193.js; enables dynamic code execution.
• dom_xss_sink_no_csp crx innerHTML sink in JS + csp_present=false on MV3 extension; DOM-XSS risk unmitigated.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted; broad backend surface for WhatsApp CRM data.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — waTidy : CRM no whatsapp, Automações e Ferramentas para venda [adware] + malext.io malicious_extension_sentry; score 5.51 -> 8.01 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low risk on its own.
• storage low Standard local data persistence.
• alarms low Scheduling; low standalone risk.
• tabs medium Can enumerate open tabs and URLs; moderate risk.
• https://web.whatsapp.com/* medium Scoped host permission; enables content script on WhatsApp Web only.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping