Top Risks

• WhatsApp impersonation: brand_mention confirms unverified WhatsApp impersonation by unknown dev 'ewdht'.
• Uninstall+install URL hijack: both hooks present, redirecting users to third-party on install/uninstall.
• Privacy policy is Google's generic policy — completely unscoped to this extension, admits data collection and 3rd-party sharing.
• 10+ external wascript.com.br / watools.com.br hosts contacted from WhatsApp Web context — broad exfil surface.
• new Function() constructor used inside content script running on WhatsApp Web — dynamic code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• uninstall_url_hijack + install_url_hijack crx Both uninstall_url_hijack and install_url_hijack are true; install target is https://web.whatsapp.com.
• generic_google_privacy_policy store Privacy URL points to myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains contacted from WhatsApp Web content script context.
• function_constructor crx new Function() call detected in content script; dynamic code execution within WhatsApp Web session.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; DOM-XSS risk without CSP guard.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit CSP hardening.
• unverified_developer store Developer 'ewdht' with email contato@extensao.store; no verified publisher badge, 8 installs only.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm but enables data hoarding.
• storage low Standard key-value storage; low risk alone.
• alarms low Schedules background tasks; minimal risk.
• tabs medium Can enumerate tab URLs/titles; moderate privacy exposure.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including DOM, messages, and contacts.

Pillar Scores

Bookkeeping