Top Risks

• Privacy policy is Google's generic policy — does not scope data collection to this extension (D clause: +10.0 privacy).
• Uninstall and install URL hijacks detected; opens web.whatsapp.com on install and hijacks uninstall flow.
• WhatsApp brand impersonation by unverified developer 'ewdht' on throwaway-style domain extensao.store.
• 10+ distinct external JS hosts on wascript.com.br/watools.com.br with no CSP — remote code loading surface.
• new Function() constructor in content script running inside WhatsApp Web session — code-execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true; install redirects to https://web.whatsapp.com.
• external_js_hosts crx 11 distinct external hosts including api-whatsapp.wascript.com.br, code.wascript.com.br, dev.watools.com.br with no CSP.
• function_constructor crx new Function() constructor in content script injected into WhatsApp Web — arbitrary code execution risk.
• no_csp manifest csp_present=false and MV3; dom_sink_innerhtml_userctrl present → code quality DOM-sink amplifier applies.
• unknown_developer store Developer name 'ewdht' is opaque; not verified publisher, not featured; email on extensao.store.
• high_js_file_count crx 334 JS files scanned; large surface area for a WhatsApp CRM with low install count (200).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduled callbacks; minimal risk.
• tabs medium Can read tab URLs and titles; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; allows content-script injection into sensitive messaging session.

Pillar Scores

Bookkeeping