Top Risks

• Privacy policy is Google's own policy, not scoped to this extension — admits data collection and 3rd-party sharing without extension scope (D rule: +10.0).
• Uninstall URL hijack and install URL hijack both flagged — classic monetization/tracking shell pattern.
• Brand impersonation: WhatsApp and Google brands mentioned; developer is not a confirmed owner.
• 10 external wascript.com.br / watools.com.br endpoints with no CSP; remote code loading surface is large.
• function_constructor (new Function) found in 334 JS files with no CSP — dynamic code execution risk.

Evidence

• privacy_policy_generic_google store Privacy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → v3.5 rule D: +10.0.
• uninstall_and_install_url_hijack crx uninstall_url_hijack=true and install_url_hijack=true; install target=https://web.whatsapp.com. Webstore +3.0+2.0.
• brand_impersonation store brands_mentioned=[whatsapp,google], confirmed_owner=false, is_impersonation=true; not verified/featured → Reputation +2.0.
• external_hosts_broad crx 10 distinct wascript.com.br/watools.com.br endpoints; >3 distinct registrable domains → Network +1.5.
• no_csp manifest csp_present=false on MV3; does not trigger MV2 +2.0 bonus but amplifies code risk (dom_sink + no CSP → +2.0).
• function_constructor crx new Function() constructor detected; maps to debugger_attach/function_constructor signal → Code Quality +2.5.
• dom_sink_innerhtml_no_csp crx innerHTML from variable with csp_present=false → FIX B applies: +2.0 code quality.
• reputation_no_verified_publisher store No verified publisher badge, no featured badge, developer domain extensao.store not confirmed brand owner.

Permissions Breakdown

• tabs medium Can read tab URLs and titles; moderate info exposure.
• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large local data caching.
• storage low Standard local storage access; low risk on its own.
• alarms low Scheduled background tasks; low risk.
• https://web.whatsapp.com/* (host) medium Full content access to WhatsApp Web; can read messages and DOM.

Pillar Scores

Bookkeeping