Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10.0 privacy).
• Brand impersonation: mentions WhatsApp and Google without verified ownership; not a verified or featured publisher.
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com indicating tracking/onboarding abuse.
• 10+ distinct external JS hosts under wascript.com.br/watools.com.br with no CSP — broad remote network surface on WhatsApp session.
• new Function() constructor in content script running on WhatsApp Web enables dynamic code execution against sensitive chat data.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp and Google; developer domain extensao.store is not confirmed owner.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com on install.
• broad_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints as js_external_hosts; no CSP to constrain outbound requests.
• function_constructor crx new Function() found in content script operating on WhatsApp Web — dynamic code execution risk.
• dom_xss_sink crx innerHTML set from variable in content script on WhatsApp Web; no CSP present (csp_present=false).
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP restricts script-src or connect-src.
• low_install_count store Only 42 installs; unverified publisher; operates on high-value WhatsApp Web session data.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but can store large datasets.
• storage low Standard key-value local storage access.
• alarms low Scheduled task execution; low risk in isolation.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; allows reading/modifying all WhatsApp messages.

Pillar Scores

Bookkeeping