Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; onInstalled redirects to web.whatsapp.com.
• Brand impersonation: extension claims Google affiliation via Google privacy policy URL; dev is not verified.
• 10 external wascript.com.br / watools.com.br endpoints contacted; no CSP; remote code loading risk.
• function_constructor (new Function) present; combined with no CSP elevates DOM-XSS and code injection risk.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; uninstall_url_target is null but hijack flag is true.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com on install.
• brand_impersonation store brand_mention.is_impersonation=true; brands_mentioned=[google]; dev not verified owner of google.
• generic_privacy_policy store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; no CSP.
• function_constructor crx new Function() constructor found in bundled JS; no CSP to mitigate code injection.
• dom_xss_sink crx innerHTML assigned from variable without CSP; DOM-XSS risk on WhatsApp Web content.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit restriction on connect-src.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm potential.
• storage low Standard key-value storage; low risk.
• alarms low Scheduled tasks; low risk alone.
• tabs medium Can read tab URLs and metadata; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/modify WhatsApp messages.

Pillar Scores

Bookkeeping