Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (+10 privacy).
• Uninstall URL hijack flagged; install hook opens web.whatsapp.com — behavioural anomalies (+3+2 webstore).
• WhatsApp brand impersonation by unverified developer contato@extensao.store (+2 reputation).
• 10 distinct external wascript.com.br / watools.com.br endpoints contacted; broad outbound surface (+1.5 network).
• function_constructor (new Function) in content script running on WhatsApp Web; DOM-XSS innerHTML sink also present.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set — triggers +3.0 webstore penalty.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — +2.0 webstore penalty.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not a confirmed Meta/WhatsApp owner.
• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• external_hosts_count crx 10 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; broad backend surface.
• function_constructor crx new Function() constructor detected in content script — elevated code-execution risk on WhatsApp Web.
• dom_sink_innerhtml crx innerHTML from variable in content script; no CSP present → upgraded to +2.0 code quality.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit restriction declared).

Permissions Breakdown

• unlimitedStorage low Allows large local storage; limited direct harm.
• storage low Standard local data persistence.
• alarms low Scheduling only; low risk.
• tabs medium Can read tab URLs/titles; moderate info-disclosure risk.
• https://web.whatsapp.com/* medium Content-script access to WhatsApp Web; can read all messages displayed.

Pillar Scores

Bookkeeping