Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and third-party sharing (v3.5 D → +10.0 privacy).
• WhatsApp impersonation: brand_mention.is_impersonation=true, developer is not confirmed owner of WhatsApp brand.
• No CSP + 12 distinct external JS hosts including dev.watools.com.br and react.dev — broad remote code surface.
• Uninstall URL hijack and install URL hijack flags set; install target redirects to web.whatsapp.com.
• function_constructor and innerHTML DOM-sink findings in content scripts running on WhatsApp Web sessions.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation_whatsapp store brand_mention lists 'whatsapp', confirmed_owner=false, is_impersonation=true; verified publisher does not offset brand ownership gap.
• no_csp_mv3 manifest csp_present=false; 12 external JS hosts contacted including react.dev and dev.watools.com.br; remote code loading surface.
• uninstall_and_install_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true; install target opens web.whatsapp.com.
• code_function_constructor crx new Function() constructor found in content script v_7_4_3_80_a02ccfb2 — code execution from string.
• code_dom_sink_innerhtml crx innerHTML assignment from variable in content script with csp_present=false → elevated XSS risk (+2.0 FIX B).
• verified_publisher_no_dev_name store verified_publisher=true but developer_name is empty string; reduces some reputation concern but cap applies.
• tiny_install_count store Only 22 installs; low blast radius but high-capability access to WhatsApp Web messages/contacts.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; minor risk in isolation.
• storage low Standard local data persistence; low risk.
• alarms low Scheduling/timers; low risk.
• tabs medium Can read tab URLs and titles; moderate risk on WhatsApp sessions.
• https://web.whatsapp.com/* high Full content script + host access to WhatsApp Web — can read all messages and contacts.

Pillar Scores

Bookkeeping