Top Risks

• Operator cluster of 21 sibling extensions under same dev email — coordinated deployment pattern.
• Uninstall and install URL hijack active; opens WhatsApp Web on install.
• Privacy policy is Google's generic policy — does not scope data collection to this extension at all.
• Brand impersonation: mentions WhatsApp and Google without verified ownership.
• 10 external JS hosts on wascript.com.br / watools.com.br with no CSP; function_constructor and innerHTML DOM-XSS sinks present.

Evidence

• operator_cluster_siblings api 21 sibling extensions share same dev email, install_url, and CSP host set — coordinated shell cluster.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; install_url_hijack also true, opens web.whatsapp.com on install.
• privacy_policy_generic store Policy URL is Google's own account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention.is_impersonation=true; mentions WhatsApp and Google; developer domain extensao.store not confirmed owner.
• external_js_hosts crx 10 distinct external hosts (wascript.com.br, watools.com.br variants) contacted; no CSP enforced (MV3 null CSP).
• code_function_constructor crx new Function() constructor found in 4 JS files across crm/, fluxo/, funnil/, content/ directories.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script; DOM-XSS sink; csp_present=false amplifies risk.
• no_verified_publisher store No verified publisher badge, not featured by Google; 271 installs only; dev domain extensao.store age ~982 days.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables caching large payloads.
• storage low Standard local key-value storage; low risk alone.
• alarms low Scheduled task execution; low risk in isolation.
• tabs medium Can read tab URLs and titles across browser; medium privacy exposure.
• https://web.whatsapp.com/* high Full access to WhatsApp Web DOM and messaging content; high sensitivity.

Pillar Scores

Operator Siblings (24)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping