Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10.0 privacy).
• Brand impersonation of WhatsApp without verified ownership raises deception risk (+2.0 reputation).
• Uninstall URL hijack and install URL hijack flagged — monetization/tracking shell pattern (+3.0+2.0 webstore).
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no CSP — broad outbound network surface.
• function_constructor (new Function()) and innerHTML DOM-XSS sink in content script running on WhatsApp Web.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• broad_external_hosts crx 10+ distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP (csp_present=false).
• function_constructor crx new Function() constructor found in content script; maps to +2.5 code quality risk.
• dom_sink_innerhtml crx innerHTML from variable in content script with no CSP present — elevated DOM-XSS risk (+2.0).
• no_csp_mv3 manifest content_security_policy=null; MV3 default CSP applies but no explicit policy; amplifies code findings.
• installs_100k store 100,000 installs increases blast radius of any malicious behaviour.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk on its own.
• storage low Standard local data persistence; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate sensitivity.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all conversation content.

Pillar Scores

Bookkeeping