Top Risks

• Uninstall and install URL hijacks confirmed — classic monetization/redirect shell behaviour.
• Privacy policy is Google's own policy (scope_extension=false, admits data collection + 3rd-party sharing) — worst-case Privacy score.
• WhatsApp brand impersonation (confirmed_owner=false) by unverified developer 'wsll'.
• 10+ distinct external JS hosts on wascript.com.br / watools.com.br — large undisclosed network surface.
• new Function() constructor found; DOM-XSS innerHTML sink present; no CSP — elevated code-quality risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstalled and setUninstallURL hooks confirmed; install redirects to web.whatsapp.com — monetization shell pattern.
• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy; scope_extension=false, data_collection=true, third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, developer domain extensao.store has no Meta affiliation.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains loaded externally; not declared as safe origins.
• function_constructor crx new Function() used in content script — arbitrary code execution risk on WhatsApp Web session.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script; no CSP to mitigate DOM-XSS.
• unverified_developer store Developer 'wsll', email contato@extensao.store; not verified publisher, not featured; generic .store TLD.
• large_js_footprint crx 334 JS files scanned for a CRM tool; disproportionate surface area for stated scope.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; minor risk in isolation.
• storage low Standard key-value storage, low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function.

Pillar Scores

Bookkeeping