Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: extension is not affiliated with Meta/WhatsApp (brand_mention.is_impersonation=true).
• Uninstall and install URL hijack flags both set; typical low-quality monetization shell pattern.
• 10 distinct external wascript.com.br / watools.com.br hosts contacted — large unreviewed backend surface.
• new Function() constructor and unguarded innerHTML sink present without CSP (csp_present=false).

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store PP URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; uninstall_url_hijack=true.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com; install_url_hijack=true.
• external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br subdomains as JS external hosts; unverified third-party backend.
• function_constructor crx new Function() in JS bundle; dynamic code execution risk without CSP.
• dom_xss_sink crx innerHTML assigned from variable in content script on WhatsApp Web; DOM-XSS risk without CSP.
• no_csp manifest content_security_policy=null; no CSP protection for MV3 extension with dynamic code patterns.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low standalone risk.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; enables full DOM/message interception on that origin.

Pillar Scores

Bookkeeping