Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Waat: CRM e Vendas no WhatsApp Web [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer 'ewdht' on throwaway-sounding domain.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com.
• 10+ external wascript.com.br / watools.com.br endpoints contacted from content script on WhatsApp Web.

Evidence

• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not affiliated with Meta.
• install_uninstall_hijack manifest uninstall_url_hijack=true and install_url_hijack=true; install redirects to https://web.whatsapp.com.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; broad back-end surface on WhatsApp content script.
• function_constructor crx new Function() used in JS bundle — dynamic code execution risk.
• dom_xss_sink crx innerHTML set from variable with no CSP; DOM-XSS sink inside WhatsApp Web context.
• reputation_weak_dev store Developer name 'ewdht' is opaque; no verified publisher badge; no featured badge; .store TLD.
• csp_absent manifest content_security_policy=null; csp_present=false on MV3 extension with DOM-sink and Function() findings.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Waat: CRM e Vendas no WhatsApp Web [adware] + malext.io malicious_extension_sentry; score 3.71 -> 6.21 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard key-value local storage; minimal risk on its own.
• alarms low Scheduling alarms; minimal risk, used for automation tasks.
• tabs medium Can read tab URLs and titles; scoped to WhatsApp but still a privacy surface.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; can read/modify all WhatsApp messages and contacts.

Pillar Scores

Bookkeeping