Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack both present; install redirects to web.whatsapp.com.
• Brand impersonation: mentions 'google' but developer is unverified and domain is extensao.store.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) with no CSP; dynamic code loading surface.
• new Function() constructor found in bundled JS — arbitrary code execution risk on WhatsApp Web DOM.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; uninstall_url_hijack=true.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — 3rd-party redirect on install.
• generic_privacy_policy store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation store brand_mention lists 'google', confirmed_owner=false, is_impersonation=true.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP to restrict them.
• function_constructor crx new Function() found in content script — dynamic code execution on WhatsApp Web page.
• dom_sink_innerhtml crx innerHTML assigned from variable; CSP absent, raising XSS risk in WhatsApp Web context.
• low_install_count store Only 29 installs; limited blast radius today but high-capability backend infrastructure is disproportionate.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm but enables data hoarding.
• storage low Standard local key-value storage; minimal risk.
• alarms low Scheduled tasks; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host access; limits reach but grants full DOM access to WhatsApp Web.

Pillar Scores

Bookkeeping