Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain (extensao.store) is not affiliated with Meta/WhatsApp.
• Both install and uninstall URL hijacks present; install redirects user to web.whatsapp.com.
• 10 external wascript.com.br/watools.com.br endpoints contacted — large outbound surface for a 16-install CRM tool.
• function_constructor (new Function) in content script on WhatsApp Web — dynamic code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy api Privacy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• install_uninstall_hijack crx uninstall_url_hijack=true, install_url_hijack=true; install target https://web.whatsapp.com.
• external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; large outbound surface.
• function_constructor crx new Function() constructor found in content script injected into WhatsApp Web.
• dom_xss_sink crx innerHTML assigned from variable in content script; no CSP present to mitigate DOM-XSS.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.
• low_install_count store Only 16 installs; unverified publisher, throwaway-style dev name 'Stfl'.

Permissions Breakdown

• unlimitedStorage low Local storage quota removal; minimal risk without exfil path.
• storage low Standard key-value storage, limited blast radius.
• alarms low Scheduling API; low direct risk.
• tabs medium Can read tab URLs and titles across browser; moderate privacy surface.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; allows content-script injection on messaging platform.

Pillar Scores

Bookkeeping