Top Risks

• WhatsApp brand impersonation by unverified developer 'wty' at extensao.store — high identity risk.
• Privacy policy is Google's generic policy, not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected — monetization/tracking behavior at lifecycle events.
• 10 distinct external JS hosts (wascript.com.br, watools.com.br) contacted — broad outbound surface for a 20-install CRM tool.
• function_constructor (new Function) combined with no CSP and innerHTML DOM sink raises code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to WaClinic; data_collection+3rd_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• broad_external_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains as JS external hosts for a 20-install extension.
• function_constructor crx new Function() constructor found in bundled JS; no CSP to constrain execution context.
• dom_xss_sink crx innerHTML assigned from variable in content script running on web.whatsapp.com — DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit restriction on connect-src).
• unverified_developer store verified_publisher=false, is_featured_by_google=false, developer_name='wty', only 20 installs.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low direct harm but can cache scraped WhatsApp data.
• storage low Standard key-value storage; low risk on its own.
• alarms low Background scheduling; low risk.
• tabs medium Can read tab URLs and metadata; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web only; can read/modify all WhatsApp DOM and network traffic on that origin.

Pillar Scores

Bookkeeping