Top Risks

• Google privacy policy used as extension's own — does not disclose what this extension collects (+10 Privacy).
• WhatsApp brand impersonation by unverified developer 'Intzp' on domain extensao.store.
• Uninstall and install URL hijack signals detected — potential traffic redirect on extension lifecycle events.
• new Function() constructor in content script running on WhatsApp; no CSP to mitigate code injection.
• 10 external hosts under wascript.com.br / watools.com.br contacted — large backend surface with AI processing of WhatsApp data.

Evidence

• privacy_policy_google_generic store Privacy policy points to Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed Meta/WhatsApp owner.
• uninstall_url_hijack manifest uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com on onInstalled.
• function_constructor crx new Function() constructor detected in content script; no CSP present, raising code injection risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script with no CSP — DOM-XSS sink on WhatsApp page.
• external_hosts_broad crx 10 wascript.com.br / watools.com.br external hosts; AI/sales automation implies WhatsApp message data exfil to third-party backend.
• no_csp manifest content_security_policy is null; no mitigation for dynamic code execution or XSS in MV3 extension.
• reputation_unverified store verified_publisher=false, is_featured_by_google=false, developer 'Intzp' at free-TLD domain extensao.store, 92 installs.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; minor risk on its own.
• storage low Standard local key-value storage, low risk.
• alarms low Scheduling; no data access.
• tabs medium Can read tab URLs and metadata; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp only; can read/modify all page content there.

Pillar Scores

Bookkeeping