Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack present; install redirects to web.whatsapp.com suggesting tracking.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no bad-host hits but large undisclosed backend surface.
• function_constructor (new Function) and unguarded innerHTML sink detected in 334-file JS bundle with no CSP.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true — scores +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• uninstall_url_hijack manifest uninstall_url_hijack=true, install_url_hijack=true; install redirects to https://web.whatsapp.com.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains as external JS hosts; large undisclosed backend surface.
• function_constructor crx new Function() constructor detected in v_7_4_3_80_...193.js — dynamic code execution risk.
• dom_xss_sink crx innerHTML from variable in v_7_4_3_80_...12.js; no CSP present to mitigate DOM-XSS.
• no_csp manifest content_security_policy is null (MV3 default strict applies, but no explicit CSP declared; dom_sink risk elevated).
• not_verified_publisher store verified_publisher=false, is_featured_by_google=false; developer 'Intzp' has no verifiable reputation.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but can accumulate large data.
• storage low Standard local storage access; low risk.
• alarms low Schedules periodic tasks; low risk alone.
• tabs medium Can read tab URLs and titles; moderate risk for user tracking.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; allows content script injection and data access on that domain.

Pillar Scores

Bookkeeping