Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com indicating redirect behavior.
• WhatsApp brand impersonation: developer domain is extensao.store, not Meta/WhatsApp.
• 10+ distinct external wascript.com.br / watools.com.br backend hosts receiving data from WhatsApp Web content scripts.
• function_constructor (new Function) present in content script — dynamic code execution risk against WhatsApp messages.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both uninstall and install URL hijacks flagged; install target is https://web.whatsapp.com.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store not confirmed owner; is_impersonation=true.
• generic_privacy_policy store Privacy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints contacted from content script on WhatsApp Web.
• function_constructor crx new Function() found in content script; dynamic code execution risk within WhatsApp Web context.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; DOM-XSS sink without CSP protection.
• no_csp manifest content_security_policy is null; no CSP mitigation for eval/innerHTML findings.
• low_install_count store Only 15 installs; combined with brand impersonation and hijack flags raises tail-attack risk.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard local key-value storage; minimal risk.
• alarms low Scheduling background tasks; low risk on its own.
• tabs medium Can read tab URLs/titles across browser; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; content scripts can read/modify all messages.

Pillar Scores

Bookkeeping