Top Risks

• Uninstall URL hijack detected — extension overrides Chrome's uninstall callback to a third party.
• Install URL hijack opens https://web.whatsapp.com on install — unsolicited navigation.
• Privacy policy is Google's generic policy (not scoped to this extension) while data_collection and third_party_sharing are admitted.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 12 external JS hosts across multiple wascript.com.br subdomains plus third-party tracking domains (t.17track.net, linkcorreios.com.br).

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target unset but hijack flag true — monetization/tracking on uninstall.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — unsolicited redirect on install.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to Uai Leads; data_collection+third_party_sharing admitted.
• brand_impersonation store brand_mention: WhatsApp mentioned; confirmed_owner=false; developer domain extensao.store has no Meta affiliation.
• high_external_host_count crx 12 distinct external JS hosts: 8 wascript.com.br subdomains, t.17track.net, web.whatsapp, web.whatsapp.com, www.linkcorreios.com.br.
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — full DOM access to WhatsApp Web chat interface.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening declared.
• short_dev_name store Developer name is 'wty' — minimal identity signal; not a verified publisher.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data accumulation.
• storage low Standard local key-value storage; low risk in isolation.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles across all tabs; moderate privacy surface.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM content on that origin.

Pillar Scores

Bookkeeping