Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DBX Whats: Automação, CRM e Chatbot para Vendas no WhatsApp Web [credential-theft] + malext.io malicious_extension_sentry (+2.5, capped).
• WhatsApp brand impersonation by unverified free-webmail developer (wl.exten.01@gmail.com).
• Content script on web.whatsapp.com has full DOM access to user messages and contacts.
• Install URL hijack opens https://web.whatsapp.com on install — minor but indicates tracking intent.
• innerHTML DOM-XSS sink in bundled vendor JS with no CSP to mitigate exploitation.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer confirmed_owner=false, email is gmail.com.
• free_webmail_developer store Developer email wl.exten.01@gmail.com — numbered alias pattern on free webmail, no business domain.
• install_url_hijack manifest install_url_hijack=true; onInstalled opens https://web.whatsapp.com (low severity but confirms tracking hook).
• content_script_whatsapp manifest Content script scoped to https://web.whatsapp.com/* — full DOM read/write over chat messages.
• dom_sink_innerhtml crx innerHTML assignment in vendor.BaH-a-x7.js; no CSP present (csp_present=false), elevating XSS risk.
• no_csp manifest content_security_policy=null on MV3 extension; default MV3 CSP applies but no explicit hardening.
• privacy_policy_third_party_domain store Privacy policy at privacy.opt-api.com — not developer-controlled domain; scope_extension=true, data_collection=true.
• low_install_unverified store Only 430 installs; unverified publisher; rating 3.3 with no verified business identity.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DBX Whats: Automação, CRM e Chatbot para Vendas no WhatsApp Web [credential-theft] + malext.io malicious_extension_sentry; score 3.08 -> 5.58 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct abuse potential.
• storage low Standard local key-value storage for extension state.
• tabs medium Can read tab URLs and metadata; moderate privacy surface.
• alarms low Scheduling only; no data access.
• content_scripts:https://web.whatsapp.com/* medium Full DOM access on WhatsApp Web; can read messages and contacts.

Pillar Scores

Bookkeeping