Top Risks

• Operator cluster of 21 sibling extensions under same dev email — mass-deployment fingerprint, extreme supply-chain risk.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing → Privacy pillar 10.0.
• Uninstall URL hijack flag set and install URL hijack redirects to web.whatsapp.com — classic monetization shell pattern.
• WhatsApp brand impersonation by unverified developer; extension injects into WhatsApp Web and contacts 10+ external wascript.com.br/watools.com.br endpoints.
• new Function() constructor found in 4 files with no CSP; DOM-XSS innerHTML sink present — code execution risk inside WhatsApp session.

Evidence

• operator_cluster_siblings api 21 sibling extensions share same dev email, install-URL, and external host set — coordinated deployment ring.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not confirmed owner; is_impersonation=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• privacy_policy_generic store Privacy policy is Google account policy (not extension-scoped); scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints contacted; broad external reach for a scoped WhatsApp tool.
• function_constructor crx new Function() in 4 JS files; no CSP present — dynamic code execution risk inside WhatsApp Web content script.
• dom_xss_sink crx innerHTML assigned from variable with no CSP and no CVE exemption → elevated DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 has strict default but external host contact and Function() raise residual risk.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct risk but could cache sensitive WhatsApp data.
• storage low Standard local key-value storage; low risk.
• alarms low Background scheduling; low risk alone.
• tabs medium Can read tab URLs and metadata; medium risk in combination with host access.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; allows content injection into chat session.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping