Top Risks

• Uninstall + install URL hijack: extension fires onInstalled/onUninstalled hooks to third-party URLs.
• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension; admits data collection and third-party sharing.
• WhatsApp impersonation (brand_mention.is_impersonation=true) by free-webmail developer with no business domain.
• 12 external JS hosts across 4 countries including multiple wascript.com.br backend endpoints contacting WhatsApp session context.
• function_constructor + innerHTML DOM-XSS sink in content script running against WhatsApp Web with no CSP.

Evidence

• install_url_hijack + uninstall_url_hijack crx onInstalled opens https://web.whatsapp.com; uninstall URL hijack also present — classic monetization/tracking shell pattern.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, developer is free-webmail (gmail.com), not a verified WhatsApp/Meta partner.
• free_webmail_developer store Developer email tiagolau@gmail.com; no business domain; reputation floor triggered.
• geo_diversity_4_countries crx JS hosts span BR, CA, GB, US (count=4); category is Productivity — +1.5 network.
• function_constructor_code_finding crx new Function() constructor found in content script injected into WhatsApp Web — +2.5 code quality.
• dom_sink_innerhtml_csp_absent crx innerHTML from variable + csp_present=false → FIX B applies, +2.0 code quality.
• webstore_uninstall_url_hijack store chrome.runtime.setUninstallURL() to third party signals monetization shell: +3.0 webstore.

Permissions Breakdown

• unlimitedStorage low Local storage quota removal; low direct harm potential.
• storage low Stores extension state locally; minimal risk.
• alarms low Scheduled tasks only; low risk.
• tabs medium Can read tab URLs and titles across browser; moderate privacy surface.
• content_scripts_matches: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read all messages/contacts on that page.

Pillar Scores

Bookkeeping