Top Risks

• Privacy policy is Google's own generic policy — not scoped to this extension at all; admits data collection and 3rd-party sharing.
• Uninstall URL hijack active; install_url_hijack redirects to web.whatsapp.com on install — monetization/tracking pattern.
• 12 external JS hosts contacted including multiple wascript.com.br endpoints; remote code loading surface on WhatsApp DOM.
• Brand impersonation: extension uses Google's privacy policy URL creating false legitimacy association; dev is unverified gmail account.
• new Function() constructor in content script running against WhatsApp Web enables dynamic code execution in sensitive context.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall URL hooks set; install redirects to web.whatsapp.com — monetization/tracking shell pattern.
• generic_google_privacy_policy store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to GmCrm; data_collection+3rd_party_sharing=true.
• brand_impersonation store brand_mention lists 'google', confirmed_owner=false, is_impersonation=true; developer is unverified gmail user.
• external_js_hosts crx 12 external hosts: wascript.com.br (x7), watools.com.br, gmsolucoes.site, 17track.net, linkcorreios.com.br — broad remote surface.
• function_constructor crx new Function() constructor found in content script running on web.whatsapp.com — dynamic code execution risk.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script with csp_present=false — DOM-XSS sink elevated risk.
• free_webmail_developer store Developer email gmcomercio22@gmail.com; no verified publisher badge; no business domain resolvable.
• no_csp manifest content_security_policy is null on MV3 extension with external hosts and code-quality findings — no injection mitigation.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct risk but enables large local data accumulation.
• storage low Standard local/sync storage API; limited risk in isolation.
• alarms low Enables background scheduling; low risk on its own.
• tabs medium Can read tab URLs and titles; moderate risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host permission; grants full DOM access to WhatsApp Web including messages and contacts.

Pillar Scores

Bookkeeping