Top Risks

• Operator cluster of 11 sibling extensions under same dev email — mass-deployment monetization ring.
• Uninstall and install URL hijack both active; onInstalled redirects to web.whatsapp.com (tracking installs).
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing.
• 10+ distinct wascript.com.br/watools.com.br external JS hosts contacted; large remote-code surface in WhatsApp context.
• Brand impersonation: lists Google brands without verified ownership; developer domain is extensao.store.

Evidence

• operator_cluster_siblings api 11 sibling extensions share same dev email, install URL, and JS host fingerprint — indicates coordinated extension farm.
• uninstall_url_hijack + install_url_hijack crx Both hijack flags true; install redirects to https://web.whatsapp.com for tracking.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not extension-scoped; admits 3rd-party sharing.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints — remote code execution surface on WhatsApp Web.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not a confirmed Google owner.
• function_constructor crx new Function() used in JS — dynamic code execution risk, especially with no CSP.
• dom_sink_innerhtml_userctrl + csp_absent crx innerHTML sink with no CSP; DOM-XSS risk elevated in WhatsApp content-script context.
• no_verified_publisher store Not verified, not featured; developer name 'whscl' is opaque; email on extensao.store domain.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm alone.
• storage low Standard key-value storage; low risk.
• alarms low Background scheduling; low risk alone.
• tabs medium Can read tab URLs and titles across sessions.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web; can read/modify all WhatsApp content and messages.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping