Top Risks

• WhatsApp impersonation: brand_mention.is_impersonation=true, developer not confirmed owner of WhatsApp.
• Uninstall + install URL hijack both flagged; classic monetization/redirect shell pattern.
• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension at all.
• 10 distinct external wascript.com.br / watools.com.br endpoints contacted; broad backend surface on WhatsApp CRM data.
• new Function() constructor in content script on WhatsApp Web enables arbitrary code execution risk.

Evidence

• brand_impersonation api brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack + install_url_hijack manifest Both uninstall_url_hijack and install_url_hijack are true; install redirects to web.whatsapp.com.
• generic_privacy_policy store Privacy policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 12 external JS hosts, 10 under wascript.com.br/watools.com.br — large backend surface for WhatsApp data.
• function_constructor crx new Function() call found in content script injected into WhatsApp Web — arbitrary code execution risk.
• dom_sink_innerhtml crx innerHTML assignment from variable in content script; no CSP present — DOM-XSS risk elevated.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit CSP hardening declared).
• tiny_install_count store Only 3 installs; combined with WhatsApp brand impersonation and URL hijacks suggests early-stage or test deployment.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone, relevant for CRM data.
• storage low Standard local storage access, low risk.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles; enables surveillance of browsing context.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; can read/write page content including messages.

Pillar Scores

Bookkeeping