Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits 3rd-party data sharing; scores +10.0.
• WhatsApp brand impersonation: dev domain extensao.store is not Meta/WhatsApp; is_impersonation=true.
• Uninstall URL hijack and install URL hijack both flagged; onInstalled redirects to web.whatsapp.com but pattern is present.
• 10+ distinct external wascript.com.br/watools.com.br endpoints; no CSP; function_constructor code finding.
• dom_sink_innerhtml_userctrl with no CSP present escalates XSS risk on WhatsApp Web session.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; dev domain extensao.store confirmed_owner=false.
• privacy_policy_generic store Policy URL is Google's global policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true flagged in manifest data.
• js_external_hosts crx 12 external hosts across wascript.com.br and watools.com.br; >3 distinct registrable domains.
• no_csp crx content_security_policy=null / csp_present=false on MV3 extension with remote hosts and JS sinks.
• function_constructor crx new Function() usage in bundled JS — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in content script on WhatsApp Web; no CSP → elevated DOM-XSS risk.
• reputation_no_verified_publisher store verified_publisher=false, is_featured=false, free-TLD dev email, small-install WhatsApp CRM.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm.
• storage low Standard key-value store; minimal risk.
• alarms low Background scheduling; no direct data access.
• tabs medium Can read tab URLs and titles; moderate privacy impact.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web — can read/modify all messages shown in DOM.

Pillar Scores

Bookkeeping