Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack flagged; install redirect to web.whatsapp.com on install.
• WhatsApp brand impersonation: developer domain (extensao.store) is not affiliated with Meta/WhatsApp.
• function_constructor (new Function) + innerHTML DOM-XSS sink in content script running on WhatsApp Web.
• 9 distinct external wascript.com.br/watools.com.br backend endpoints contacted; no CSP on MV3 extension.

Evidence

• privacy_policy_generic_google store Privacy URL points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation_whatsapp crx brand_mention.is_impersonation=true, confirmed_owner=false; developer domain extensao.store has no affiliation with Meta.
• uninstall_url_hijack crx uninstall_url_hijack=true per manifest scan; install_url_hijack=true targeting https://web.whatsapp.com.
• function_constructor crx new Function() constructor found in content script; +2.5 code quality.
• dom_sink_innerhtml_no_csp crx innerHTML from variable in content script with csp_present=false; elevated to +2.0 per FIX B.
• external_hosts_count crx 9 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; >3 distinct domains → +1.5 network.
• install_uninstall_hijack_webstore store Both install and uninstall URL hijacks present; +2.0 webstore (install hijack) and +3.0 (uninstall hijack).
• reputation_no_verified_publisher store verified_publisher=false, is_featured_by_google=false, developer name 'wspd' is opaque, email on extensao.store TLD.

Permissions Breakdown

• unlimitedStorage low Local data storage expansion; low direct harm.
• storage low Standard local key-value storage.
• alarms low Scheduling; low risk in isolation.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; allows DOM access to messages.

Pillar Scores

Bookkeeping