Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WAFACIL [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing without extension-specific disclosure.
• WhatsApp brand impersonation: developer domain (extensao.store) is not confirmed Meta/WhatsApp owner.
• Uninstall and install URL hijack flags set; install_url_target redirects to web.whatsapp.com and uninstall hook present.
• 10 distinct external JS hosts under wascript.com.br / watools.com.br contacted; large attack surface for a 136-install CRM tool.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed Meta owner.
• privacy_policy_generic store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true — +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; +3.0 webstore penalty per rubric.
• install_url_hijack crx install_url_hijack=true; install_url_target=https://web.whatsapp.com; +2.0 webstore penalty.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; >3 distinct registrable domains; +1.5 network.
• function_constructor crx new Function() in content script on WhatsApp Web context; +2.5 code quality (debugger_attach/function_constructor tier).
• dom_sink_innerhtml_userctrl crx innerHTML sink with no CSP present; elevated to +2.0 code quality per FIX B (csp_present==false).
• reputation_baseline store Not verified publisher, not featured, dev name 'wty' minimal identity; base reputation 5.0 +2.0 impersonation = 7.0, floored at 7.5 per free-webmail rule check — email on custom domain so floor N/A; final 7.5 from impersonation.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WAFACIL [adware] + malext.io malicious_extension_sentry; score 3.85 -> 6.35 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows storing large amounts of data locally; low direct risk but enables data hoarding.
• storage low Standard local storage; low risk alone.
• alarms low Scheduling API; enables background polling but low standalone risk.
• tabs medium Can read tab URLs and titles; combined with WhatsApp host access raises data exposure risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all WhatsApp messages and contacts.

Pillar Scores

Bookkeeping