Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Master Engage [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Operator cluster of 11 extensions under same email/fingerprint — coordinated deployment pattern.
• WhatsApp brand impersonation by unverified developer; privacy policy is Google's generic policy.
• Uninstall URL hijack + install URL hijack both confirmed — classic monetization shell behavior.
• 10 external wascript.com.br / watools.com.br hosts contacted; no CSP; new Function() in code.

Evidence

• operator_cluster_siblings api sibling_count=10 under same dev email/install-URL/CSP-host fingerprint — coordinated extension cluster.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_and_install_url_hijack crx uninstall_url_hijack=true AND install_url_hijack=true; install target https://web.whatsapp.com.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; admits 3rd-party sharing.
• js_external_hosts_high_count crx 10 distinct external wascript.com.br / watools.com.br hosts; no CSP to constrain outbound connections.
• function_constructor_code_finding crx new Function() constructor detected in bundled JS — enables dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable with no CSP present — DOM-XSS risk on WhatsApp Web page.
• no_csp manifest content_security_policy is null; MV3 default applies but external host connections are unrestricted.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Master Engage [adware] + malext.io malicious_extension_sentry; score 6.35 -> 8.85 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard key-value storage; minimal risk on its own.
• alarms low Scheduled background tasks; low risk in isolation.
• tabs medium Access to tab URLs and metadata; can enumerate browsing context.
• https://web.whatsapp.com/* medium Scoped host access; content scripts run on WhatsApp Web and can read messages/DOM.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping