Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing: score +10.0.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com — obfuscates tracking.
• WhatsApp brand impersonation by unverified developer 'ewdht' on throwaway-style domain extensao.store.
• 10+ external JS hosts across wascript.com.br and watools.com.br domains contacted from WhatsApp Web context.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in content scripts running on WhatsApp Web.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both hijacks present; install opens https://web.whatsapp.com — classic tracking/redirect pattern.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy store Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains contacted from WhatsApp Web content script context.
• function_constructor crx new Function() in content script — dynamic code execution risk inside WhatsApp Web.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; no CSP present, elevates DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit CSP declared.
• developer_identity store Developer name 'ewdht' is opaque; not verified publisher, not featured; domain extensao.store resolves.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low standalone risk.
• storage low Standard extension storage; low risk.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles; moderate risk when paired with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all chat content visible there.

Pillar Scores

Bookkeeping