Top Risks

• Operator cluster of 13 extensions sharing same dev email/CSP-host fingerprint — coordinated shell operation.
• Privacy policy is Google's own policy (not scoped to this extension), admits data collection and 3rd-party sharing — scores as generic/deceptive.
• Uninstall and install URL hijacks detected; installs open web.whatsapp.com on install.
• Brand impersonation: extension links Google's privacy policy while not being affiliated with Google.
• 10 external wascript.com.br/watools.com.br backend hosts with no CSP; no visibility into data exfiltration.

Evidence

• operator_cluster api sibling_count=12 sharing identical dev_email, install_url, csp_host_set — coordinated cluster.
• privacy_policy_generic crx Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack=true, opens web.whatsapp.com on install.
• brand_impersonation store brand_mention.is_impersonation=true (Google brand); developer domain extensao.store not affiliated.
• js_external_hosts crx 10 external wascript.com.br/watools.com.br hosts; no CSP on MV3 extension contacting multiple backends.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML sink with user-controlled variable; no CSP present amplifies XSS risk.
• install_count_low store Only 15 installs; part of a 13-extension cluster — likely seeding phase of a coordinated campaign.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large local data accumulation.
• storage low Standard key-value storage; low risk in isolation.
• alarms low Scheduling API; low risk, used for background tasks.
• tabs medium Can read tab URLs and titles across sessions; moderate risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; content scripts can read messages and DOM.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping