Top Risks

• Operator cluster of 22 sibling extensions under same dev email — mass-deployment supply-chain risk.
• Uninstall and install URL hijack present; install redirects to web.whatsapp.com.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (→ score +10.0).
• WhatsApp brand impersonation by unverified developer 'ewdht' on extensao.store.
• 10 external JS hosts under wascript.com.br / watools.com.br contacted; no CSP to constrain them.

Evidence

• operator_cluster_siblings api 22 sibling extensions share same dev-email, install-URL, and CSP-host fingerprint — coordinated deployment cluster.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack also true; onInstalled opens https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not confirmed owner.
• privacy_policy_generic store Policy URL is Google's own myaccount privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP to restrict them.
• code_function_constructor crx new Function() used in 4 separate JS files across content, crm, fluxo, funnil bundles.
• dom_xss_sink crx innerHTML written from variable with no CSP; DOM-XSS risk on WhatsApp Web page context.
• developer_identity store Developer name 'ewdht' — opaque alias; no verified publisher badge; .store TLD domain age ~992 days.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large local caching.
• storage low Standard local key-value storage; low risk in isolation.
• alarms low Scheduled callbacks; low risk alone.
• tabs medium Can read tab URLs and titles across sessions; medium risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify all page content and messages.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping