Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Kentro [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Operator cluster of 21 sibling extensions under same dev email/fingerprint — mass-deployment factory pattern.
• Uninstall and install URL hijacks both present; onInstalled redirects to web.whatsapp.com as cover.
• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and third-party sharing (v3.5 D: +10.0).
• WhatsApp brand impersonation by unverified developer; extension runs content scripts inside WhatsApp Web accessing all messages.

Evidence

• operator_cluster_siblings api 21 sibling extensions share identical dev email + install_url + CSP host fingerprint — factory-deployed cluster.
• uninstall_and_install_url_hijack crx Both uninstall_url_hijack and install_url_hijack flagged true; install target is web.whatsapp.com.
• privacy_policy_generic_google store PP URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true; developer not confirmed owner of WhatsApp brand.
• external_backend_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; no CSP to constrain them.
• function_constructor_no_csp crx new Function() in 4 JS files; csp_present=false on MV3 extension running inside WhatsApp Web.
• dom_xss_sink_no_csp crx innerHTML from user-controlled variable with no CSP — DOM-XSS risk inside WhatsApp session.
• developer_email_elevated_tld store Developer email contato@extensao.store on .store TLD; domain age 982 days, not a recognized business.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Kentro [adware] + malext.io malicious_extension_sentry; score 6.39 -> 8.89 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large data hoarding.
• storage low Standard key-value storage; minimal risk alone.
• alarms low Scheduling API; low risk, enables persistent background tasks.
• tabs medium Can read tab URLs and titles; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; can read/modify all WhatsApp content.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping