Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — LoqueFácil - WhatsApp [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy fetched but not scoped to this extension, admits data collection and third-party sharing — worst-case privacy score.
• Brand impersonation: WhatsApp brand used, developer is not a confirmed Meta/WhatsApp owner.
• declarativeNetRequestWithHostAccess + scripting on WhatsApp Web allows message interception or UI manipulation.
• Small install base (920) with high-tier permissions is a tail-attack-surface signal.

Evidence

• privacy_policy_not_scoped api Policy fetched; scope_extension=false, data_collection=true, third_party_sharing=true — triggers +10.0 under v3.5 rule D.
• brand_impersonation store WhatsApp brand mentioned; confirmed_owner=false, is_impersonation=true; verified publisher so +1.0 reputation.
• small_install_high_perm api 920 installs with declarativeNetRequestWithHostAccess+scripting; install_perm_anomaly.small_install_high_perm=true.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — minor third-party redirect on install.
• verified_publisher store Verified publisher badge present; domain loquefacil.com resolves, not throwaway.
• no_csp manifest content_security_policy is null on MV3; MV3 has strict default so no v2 +2.0 network penalty applied.
• whatsapp_host_access manifest scripting + declarativeNetRequestWithHostAccess scoped to web.whatsapp.com enables message-level access.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; 20 JS files scanned cleanly.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — LoqueFácil - WhatsApp [credential-theft] + malext.io malicious_extension_sentry; score 4.49 -> 6.99 (+2.5 cap 2.5).

Permissions Breakdown

• tabs medium Can read tab URLs and metadata; medium risk for a WhatsApp integration.
• activeTab low Scoped to user-initiated interaction only.
• scripting high Allows programmatic script injection into pages; broad capability.
• declarativeNetRequestWithHostAccess high Can intercept/modify network requests on host-permitted pages.
• declarativeNetRequestFeedback low Read-only feedback on matched rules; low standalone risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web session including messages and contacts.
• https://app.loquefacil.com/* medium Developer's own app domain; scripting + request access here.

Pillar Scores

Bookkeeping