Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer on extensao.store domain.
• Uninstall URL hijack and install URL hijack both present — classic monetization/tracking pattern.
• 10 distinct external wascript.com.br / watools.com.br endpoints contacted by a 107-install extension; broad backend surface.
• function_constructor (new Function) in bundled JS enables dynamic code execution; combined with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; 'whatsapp' claimed, developer domain extensao.store is not Meta.
• uninstall_url_hijack crx uninstall_url_hijack=true; classic monetization/tracking signal even with null target.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://web.whatsapp.com — masked redirect origin.
• generic_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — not scoped to this extension; data_collection+third_party_sharing=true.
• external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br endpoints; large backend surface for 107-install extension.
• function_constructor_no_csp crx new Function() found in JS; csp_present=false; MV3 but no explicit CSP declared.
• dom_xss_sink crx innerHTML from variable in content script on WhatsApp Web; no CSP to mitigate.
• verified_publisher_absent store verified_publisher=false, is_featured_by_google=false; developer identity unverifiable.

Permissions Breakdown

• unlimitedStorage low Local storage quota removal; low direct risk.
• storage low Standard key-value local storage; low risk.
• alarms low Scheduled callbacks; low risk.
• tabs medium Can read URLs/titles of all open tabs; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; moderate but matches stated function.

Pillar Scores

Bookkeeping