Top Risks

• Uninstall and install URL hijacks confirmed — classic traffic-monetization shell behaviour.
• Privacy policy is Google's own policy (scope_extension=false, data_collection=true, third_party_sharing=true) — entirely inadequate for this extension.
• WhatsApp brand impersonation (confirmed_owner=false) with no verified publisher status.
• 10 external wascript.com.br / watools.com.br backend hosts contacted — wide attack surface for a 72-install CRM tool.
• function_constructor + innerHTML DOM-XSS sink found in 334 JS files with no CSP — code execution risk.

Evidence

• install/uninstall URL hijack crx uninstall_url_hijack=true, install_url_hijack=true with install target https://web.whatsapp.com — monetisation shell pattern.
• brand impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed owner.
• generic privacy policy store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• external backend hosts crx 10 distinct wascript.com.br / watools.com.br hosts in js_external_hosts; no CSP to constrain outbound requests.
• function_constructor crx new Function() constructor detected in bundled JS — dynamic code execution risk without CSP.
• dom_sink_innerhtml_userctrl + no CSP crx innerHTML assignment from variable in content script on WhatsApp Web; csp_present=false amplifies XSS risk.
• no verified publisher store verified_publisher=false, is_featured_by_google=false, developer Intzp unverifiable.
• install count vs. backend scale mismatch store Only 72 installs yet contacts 10 external backend endpoints across multiple subdomains — anomalous.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large local data accumulation.
• storage low Standard key-value storage; minimal risk.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk when combined with content scripts.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all content in that context.

Pillar Scores

Bookkeeping