Top Risks

• Google privacy policy used as extension policy — admits data collection/3rd-party sharing with no extension scope (v3.5 D: +10.0 privacy).
• WhatsApp brand impersonation: developer domain extensao.store is not Meta/WhatsApp; confirmed_owner=false (+2.0 reputation).
• Uninstall URL hijack and install URL hijack both true — traffic manipulation signal (+3.0+2.0 webstore).
• 10 distinct external JS hosts on wascript.com.br/watools.com.br; no CSP — remote code loading surface is broad.
• function_constructor (new Function) + innerHTML DOM-XSS sink with csp_present=false elevate code quality risk.

Evidence

• privacy_policy_generic_google store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, not verified → +2.0 reputation.
• uninstall_url_hijack manifest uninstall_url_hijack=true → +3.0 webstore signals.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com → +2.0 webstore signals.
• js_external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br external JS hosts; >3 distinct registrable domains → +1.5 network.
• no_csp manifest content_security_policy=null, csp_present=false on MV3; does not apply MV2+no-CSP bonus but amplifies code findings.
• function_constructor_code_finding crx new Function() constructor detected → +2.5 code quality (debugger_attach/function_constructor tier).
• dom_sink_innerhtml_no_csp crx innerHTML user-ctrl sink + csp_present=false → +2.0 code quality (FIX B).

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm but enables data hoarding.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling API; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; enables full DOM access to chat data.

Pillar Scores

Bookkeeping