Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing (+10.0 privacy).
• WhatsApp brand impersonation by unverified developer 'Intzp' on unrelated domain extensao.store (+2.0 reputation).
• Uninstall URL hijack detected (+3.0 webstore) and install URL hijack redirecting to web.whatsapp.com (+2.0 webstore).
• 10 external wascript.com.br/watools.com.br JS hosts with no CSP — remote code loading surface is high.
• function_constructor (new Function) code finding creates dynamic code execution risk in content script on WhatsApp Web.

Evidence

• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to Zaply Seller; data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not confirmed owner.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() invoked (target null but flag true); install_url_hijack to https://web.whatsapp.com.
• external_js_hosts crx 10 external wascript.com.br and watools.com.br hosts in js_external_hosts; no CSP to restrict loading.
• function_constructor crx new Function() constructor found in content script — dynamic code execution risk against WhatsApp Web DOM.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script; no CSP present — DOM-XSS sink elevated risk.
• no_csp manifest content_security_policy is null; MV3 default applies but external hosts in js_external_hosts increase surface.
• micro_install_count store Only 3 installs; no ratings. Extremely low adoption relative to 334 JS files and 10 external API hosts.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard local storage for extension state.
• alarms low Scheduling; can trigger background activity periodically.
• tabs medium Access to tab URLs/titles; enables surveillance of browsing within session.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; content scripts can read/modify all messages.

Pillar Scores

Bookkeeping