Top Risks

• new Function() in inject.js executes arbitrary string commands inside WhatsApp Web context — remote code execution vector.
• Privacy policy is Google's generic policy (not scoped to this extension) yet admits data collection and third-party sharing — effectively no real policy.
• WhatsApp brand impersonation: extension is not affiliated with Meta/WhatsApp and confirmed_owner=false.
• Install URL hijack opens web.whatsapp.com on install — mild but signals low-quality dev practices.
• growsoft.io appears in js_external_hosts but not in declared host_permissions — undisclosed third-party contact.

Evidence

• function_constructor_rce crx inject.js uses new Function() to eval arbitrary command string inside WhatsApp Web content script.
• generic_google_privacy_policy store Privacy policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to SlimSender.
• brand_impersonation store Brand 'whatsapp' mentioned; confirmed_owner=false, not verified publisher.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://web.whatsapp.com/.
• undisclosed_external_host crx growsoft.io in js_external_hosts but absent from host_permissions — undisclosed third-party endpoint.
• no_csp manifest content_security_policy is null (csp_present=false); no inline script restrictions on MV3 extension pages.
• reputation_unverified store Not verified publisher, not featured, developer name 'ferramentasmarketing', 54 installs, 0 ratings.
• privacy_policy_data_collection_third_party api Policy fetched: scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.

Permissions Breakdown

• activeTab low Grants access only to the active tab on user action; low blast radius.
• storage low Local extension storage for settings; no cross-origin data risk.
• https://web.whatsapp.com/* medium Content script runs on WhatsApp Web; can read/modify all messages and contacts.
• https://controle.dablioweb.com/* medium Outbound access to developer-controlled backend; data exfil path.
• https://api.ipify.org/* low Public IP lookup service; low risk but reveals user IP to third party.

Pillar Scores

Bookkeeping