Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Uninstall URL hijack and install URL hijack both present; onInstalled redirects user to WhatsApp Web.
• Brand impersonation: extension mentions 'WhatsApp' and 'Google' but developer is unverified and does not own those brands.
• 10+ distinct external JS hosts on wascript.com.br and watools.com.br contacted at runtime; no CSP to restrict them.
• function_constructor (new Function()) in content script running on WhatsApp Web — arbitrary code execution risk.

Evidence

• uninstall_url_hijack + install_url_hijack manifest chrome.runtime.setUninstallURL and onInstalled redirect both present; install opens https://web.whatsapp.com.
• generic_privacy_policy store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention lists google+whatsapp; confirmed_owner=false; is_impersonation=true; developer is unverified.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; no CSP; MV3 but no content_security_policy declared.
• function_constructor crx new Function() in content script on WhatsApp Web DOM — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML set from variable with no CSP; DOM-XSS sink active on WhatsApp Web page.
• no_verified_publisher store Developer 'Stfl' / contato@extensao.store; not verified, not featured; 73 installs only.
• csp_absent_mv3 manifest content_security_policy is null despite 334 JS files and remote API calls; amplifies code-quality risks.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard local key-value store; low risk in isolation.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles; combined with WhatsApp host access raises sensitivity.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; content scripts can read messages and DOM.

Pillar Scores

Bookkeeping