Top Risks

• Uninstall & install URL hijack: extension redirects users to wascript.com.br/WhatsApp on install/uninstall.
• Privacy policy is Google's own policy (not scoped to this extension), admitting data collection and 3rd-party sharing.
• Brand impersonation: mentions 'google' in brand context; developer domain (extensao.store) is unverified.
• 10 external JS hosts on wascript.com.br/watools.com.br domains expose large remote attack surface.
• function_constructor + innerHTML sink in content script running on WhatsApp Web — code execution risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target unverified. +3.0 Webstore.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — 3rd-party URL redirect. +2.0 Webstore.
• privacy_policy_google_generic store Privacy URL is myaccount.google.com/privacypolicy — generic Google policy, scope_extension=false, data_collection=true, 3rd-party=true. +10.0 Privacy (v3.5-D).
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not verified. +2.0 Reputation.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br external JS hosts; >3 distinct domains. +1.5 Network.
• function_constructor crx new Function() constructor found in content script — dynamic code execution risk. +2.5 Code Quality.
• dom_sink_innerhtml_userctrl crx innerHTML from variable in content script; no CSP present → elevated to +2.0 Code Quality (FIX B).
• no_csp manifest content_security_policy is null (MV3 but no explicit CSP); amplifies code findings risk.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm potential.
• storage low Standard local key-value storage; minimal risk.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs/titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; justified for CRM function but enables message interception.

Pillar Scores

Bookkeeping