Top Risks

• Uninstall and install URL hijack both present — aggressive monetization/tracking behavior.
• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer; confirmed_owner == false.
• 10+ distinct wascript.com.br backend hosts contacted from extension — large exfil surface on WhatsApp messages.
• function_constructor (new Function) + innerHTML DOM sink in content script on WhatsApp; code execution risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set — aggressive post-uninstall tracking.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — install redirect confirmed.
• brand_impersonation store brand_mention: WhatsApp mentioned; confirmed_owner=false; is_impersonation=true.
• generic_privacy_policy store PP is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx 10 wascript.com.br/watools.com.br endpoints; content script on WhatsApp can exfil messages.
• function_constructor crx new Function() used in content script — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML set from variable in content script; no CSP present — DOM-XSS risk elevated.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit restriction hardening).

Permissions Breakdown

• unlimitedStorage low Local storage only; low direct risk.
• storage low Standard local data persistence.
• alarms low Scheduling; low impact alone.
• tabs medium Can read tab URLs and titles; moderate info exposure.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; can read/modify all WhatsApp DOM including messages.

Pillar Scores

Bookkeeping