Top Risks

• Privacy policy is Google's generic policy — does not scope to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer 'wty' at extensao.store.
• Uninstall and install URL hijack both present; install_url redirects user to web.whatsapp.com.
• 10+ distinct external JS hosts under wascript.com.br/watools.com.br with no CSP — arbitrary server-side code update risk.
• new Function() constructor in content script running inside WhatsApp Web context — dynamic code execution risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• install_uninstall_url_hijack manifest uninstall_url_hijack=true and install_url_hijack=true; install_url_target=https://web.whatsapp.com.
• multiple_external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; no CSP; server can push arbitrary JS to content context.
• function_constructor crx new Function() found in content script — dynamic code execution inside WhatsApp Web DOM.
• dom_xss_sink crx innerHTML assigned from variable in content script with csp_present=false — DOM-XSS risk.
• no_csp manifest content_security_policy=null; MV3 default applies but external host contacts amplify risk without explicit CSP.
• developer_identity store Developer name 'wty' is opaque; email contato@extensao.store; not verified publisher, not featured.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables data hoarding.
• storage low Standard local storage access; low risk.
• alarms low Scheduling alarms; low risk, enables background automation.
• tabs medium Can read tab URLs and titles; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; content scripts inject into messaging context with full DOM access.

Pillar Scores

Bookkeeping