Top Risks

• Uninstall and install URL hijack both set — classic monetization/redirect shell pattern.
• Privacy policy points to Google's own policy — not scoped to this extension; data collection and 3rd-party sharing admitted.
• WhatsApp brand impersonation (unverified developer 'Intzp' on extensao.store domain).
• 10 external JS hosts under wascript.com.br / watools.com.br — large remote-code attack surface on WhatsApp Web sessions.
• function_constructor + innerHTML sink without CSP increases DOM-XSS and code-injection risk.

Evidence

• install_url_hijack + uninstall_url_hijack crx Both onInstalled redirect (to web.whatsapp.com) and uninstall URL hijack flagged — monetization shell indicators.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_privacy_policy store PP URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• large_external_host_set crx 12 js_external_hosts including 10 wascript.com.br/watools.com.br subdomains — broad remote surface on WhatsApp sessions.
• function_constructor crx new Function() usage detected — dynamic code execution risk in content script context.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; no CSP present — DOM-XSS risk.
• no_csp manifest content_security_policy is null (MV3 default applies but no explicit CSP tightening); amplifies code quality risk.
• very_low_installs store Only 5 installs; combined with brand impersonation and URL hijacks this matches a nascent monetization shell pattern.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling API; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* (host) medium Scoped to WhatsApp Web only; grants content-script access to chat data on that domain.

Pillar Scores

Bookkeeping