Top Risks

• Privacy policy is Google's generic policy — does not cover this extension's data collection or sharing (Privacy: 10.0).
• Uninstall URL hijack present; install redirect to web.whatsapp.com — onInstalled manipulation pattern.
• WhatsApp brand impersonation by unverified developer (contato@extensao.store / whscl), not confirmed owner.
• 10 distinct external wascript.com.br / watools.com.br endpoints; no CSP — broad outbound surface on WhatsApp session data.
• new Function() constructor and unguarded innerHTML sink in content script injected into WhatsApp Web.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; install redirect to https://web.whatsapp.com flagged.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true; developer domain extensao.store is not affiliated with WhatsApp/Meta.
• broad_external_hosts crx 10 distinct external domains under wascript.com.br and watools.com.br; no CSP to constrain them.
• function_constructor crx new Function() found in content script — dynamic code execution risk in WhatsApp context.
• dom_sink_innerhtml_userctrl crx innerHTML written from variable in content script; no CSP — DOM-XSS sink active.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.
• unverified_low_install_developer store 9 installs, no verified publisher badge, developer name 'whscl' with no known business presence.

Permissions Breakdown

• storage low Standard key-value storage for extension state.
• unlimitedStorage low Allows unbounded local storage; low direct harm but could cache exfiltrated data.
• alarms low Scheduled task trigger; low risk alone.
• tabs medium Can read tab URLs and titles across browser; moderate info-disclosure risk.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web — can read/inject into chat session; scoped to stated purpose.

Pillar Scores

Bookkeeping