Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10 privacy).
• WhatsApp Web full-scope access (cookies + scripting + content_script) enables session/message exfil.
• Developer uses free Gmail; brand_mention flags WhatsApp impersonation without confirmed owner.
• install_url_hijack redirects to web.whatsapp.com on install — minor manipulation signal.
• No CSP on MV3 extension contacting 4 distinct external JS hosts including dev backend.

Evidence

• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer_domain is gmail.com, confirmed_owner=false → +2.0 reputation.
• free_webmail_developer store Developer email appclientefiel@gmail.com is free webmail; no verified publisher badge → +1.5 reputation.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com/ → +2.0 webstore.
• cookies_plus_scripting_whatsapp manifest cookies + scripting + content_script all scoped to web.whatsapp.com; full message/session access capability.
• no_csp manifest content_security_policy=null on MV3; 4 external JS hosts contacted including ws.appclientefiel.com.br.
• external_hosts crx js_external_hosts: painel.clientefiel.app, sistema.appclientefiel.com.br, web.whatsapp.com, ws.appclientefiel.com.br.
• no_bad_hosts_no_cves api threat_intel.bad_host_hits=[], cve_findings_raw=[], obfuscation_score=0.0 — no active malware signals.

Permissions Breakdown

• webNavigation medium Can observe navigation events across host-permitted origins; scoped to whatsapp.com.
• tabs medium Access to tab URLs/titles; medium risk when paired with scripting.
• scripting high Programmatic script injection into pages; HIGH capability on whatsapp.com.
• activeTab low Transient access to active tab; lower risk when scripting is also present.
• storage low Local key-value storage; no exfil risk on its own.
• cookies high Can read/write cookies; scoped to whatsapp.com and appclientefiel.com.br — session hijack risk.
• https://web.whatsapp.com/* high Full access to WhatsApp Web including messages, contacts, and session cookies.
• https://sistema.appclientefiel.com.br/* medium Developer backend; narrowly scoped but enables data exfil to dev-controlled server.

Pillar Scores

Bookkeeping