Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack and install URL hijack flagged — redirects user on install/uninstall.
• Brand impersonation: uses Google branding (Google privacy policy URL) without being a Google product.
• 10+ external JS hosts (wascript.com.br, watools.com.br) contacted from WhatsApp Web content script context.
• function_constructor usage and innerHTML DOM-XSS sink present with no CSP.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; uninstall_url_hijack=true.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com; install_url_hijack=true.
• brand_impersonation store brand_mention.is_impersonation=true; Google mentioned; dev domain extensao.store not confirmed owner.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 external hosts under wascript.com.br / watools.com.br contacted from WhatsApp content script.
• function_constructor crx new Function() constructor found in JS bundle; code execution risk without CSP.
• dom_xss_sink crx innerHTML assigned from variable; no CSP present — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on eval/inline.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; limited direct risk alone.
• storage low Standard local data persistence.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; enables content script injection on messaging platform.

Pillar Scores

Bookkeeping