Top Risks

• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and 3rd-party sharing: +10.0 Privacy pillar.
• Uninstall URL hijack and install URL hijack detected; classic monetization/tracking shell pattern.
• WhatsApp brand impersonation by unverified dev (extensao.store) with no confirmed ownership of WhatsApp.
• 10+ external JS hosts (all wascript.com.br/watools.com.br) contacted; large remote attack surface on sensitive messaging platform.
• function_constructor (new Function) and unguarded innerHTML found in scanned JS with no CSP; DOM-XSS and code injection risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both install and uninstall URL hijacks set; classic monetization/tracking pattern. Uninstall target null, install to web.whatsapp.com.
• privacy_policy_google_generic store Privacy policy URL is Google's own policy (myaccount.google.com/privacypolicy); scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not affiliated with Meta/WhatsApp.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; broad remote code surface on WhatsApp Web context.
• function_constructor crx new Function() constructor found in scanned JS; dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable with no CSP; DOM-XSS sink in WhatsApp Web content script context.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit restriction); amplifies code-quality risk.
• reputation_weak_dev store Developer name 'wty' is opaque; no verified publisher badge; no featured badge; dev email on .store TLD domain.

Permissions Breakdown

• unlimitedStorage low Allows storing large amounts of data locally; low direct user-data risk.
• storage low Standard local key-value storage; low risk alone.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles; moderate risk for tracking browsing.
• host_permission: https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; but grants full DOM/cookie access to that sensitive messaging context.

Pillar Scores

Bookkeeping