Top Risks

• WhatsApp brand impersonation by unverified Gmail developer with no developer name.
• Content script on WhatsApp Web can read messages/DOM; install_url_hijack opens WhatsApp on install.
• Privacy policy hosted on opt-api.com (third-party generic policy domain), not developer-controlled.
• Free-webmail developer (Gmail) with no business website or verified publisher status.
• innerHTML DOM-XSS sink in vendor bundle without CSP on MV3 extension.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer is Gmail user, confirmed_owner=false.
• free_webmail_no_dev_name store Developer email oifelipegomes7@gmail.com; developer_name empty; no business website.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://web.whatsapp.com (WhatsApp brand).
• content_script_whatsapp manifest Content script injected into https://web.whatsapp.com/* — reads WhatsApp Web DOM and messages.
• dom_xss_sink crx innerHTML user-controlled assignment in vendor bundle; no CSP to mitigate.
• privacy_policy_third_party_domain store Privacy policy at privacy.opt-api.com — generic third-party policy host, not developer-controlled domain.
• external_js_hosts crx JS contacts hc-stt.hiperchat.com.br, locize.com, reactjs.org, web.whatsapp.com, www.i18next.com.
• very_low_installs store Only 15 installs; no ratings; tail-distribution extension with WhatsApp brand claim.

Permissions Breakdown

• unlimitedStorage low Allows storing large amounts of data locally; no network exfil by itself.
• storage low Basic key-value storage; low risk in isolation.
• tabs medium Can read tab URLs/titles; moderate risk for a WhatsApp CRM.
• alarms low Scheduling only; no data access.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read messages and DOM on that site.

Pillar Scores

Bookkeeping