Top Risks

• Privacy policy is Google's generic policy, not extension-scoped; admits data collection and third-party sharing — scores maximum privacy risk.
• Uninstall URL hijack detected; install URL hijack redirects to web.whatsapp.com on install.
• Content script injected into WhatsApp Web can read/modify all messages; 12 external JS hosts including third-party wascript.com.br endpoints.
• No developer identity (no name, email, or verified publisher); anonymous operator with unknown governance.
• new Function() constructor used in 608-file JS bundle with no CSP; dynamic code execution risk in WhatsApp context.

Evidence

• privacy_policy_generic_google store Privacy policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true — admits sharing without extension scope.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack=true with target https://web.whatsapp.com.
• content_script_whatsapp manifest Content script injected at https://web.whatsapp.com/* — full read/write access to WhatsApp Web DOM and messages.
• external_hosts_third_party crx 12 external JS hosts including wascript.com.br, backend.lotsofwms.in, pedeja.click — multiple unverified third-party endpoints.
• no_developer_identity store developer_name and developer_email both empty; verified_publisher=false; no accountability signal.
• function_constructor crx new Function() constructor found in 2 files within 608-JS bundle; dynamic code execution with no CSP present.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on script execution.
• no_maintenance_data api months_since_update and last_updated are null; maintenance pillar scored 0 (no data).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard local key-value storage; low risk on its own.
• alarms low Scheduling alarms; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles; moderate risk enabling browsing-pattern surveillance.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify all WhatsApp messages and DOM.

Pillar Scores

Bookkeeping