Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; data_collection and third_party_sharing both true.
• Uninstall URL hijack and install URL hijack detected — monetization/tracking lifecycle hooks.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10 external wascript.com.br / watools.com.br endpoints contacted — broad undisclosed backend surface.
• function_constructor (new Function) found in bundled JS — dynamic code execution risk.

Evidence

• privacy_policy_generic store Privacy URL points to Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called — lifecycle hijack confirmed.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install redirect confirmed.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not owned by Meta.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; undisclosed backend.
• function_constructor crx new Function() constructor found in content JS — dynamic code execution risk.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS risk.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit CSP declared.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low direct harm but enables data hoarding.
• storage low Standard local storage API; low risk on its own.
• alarms low Scheduling API; minimal risk.
• tabs medium Can read tab URLs and titles across browsing session.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web only; limited reach but sensitive messaging context.

Pillar Scores

Bookkeeping