Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer (contato@extensao.store / wspd); not affiliated with Meta.
• Uninstall URL hijack and install URL hijack both detected; classic traffic-capture pattern.
• 10 external JS hosts under wascript.com.br/watools.com.br with no CSP; remote code execution surface.
• function_constructor and innerHTML DOM-XSS sink present in scanned JS; no CSP to mitigate.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not affiliated with Meta.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• generic_privacy_policy store Privacy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 10 distinct external JS hosts under wascript.com.br / watools.com.br; no CSP declared (MV3 relaxed).
• function_constructor crx new Function() constructor found in JS bundle; code-execution risk.
• dom_xss_sink crx innerHTML assigned from variable without CSP Trusted Types; DOM-XSS sink in content script on WhatsApp.
• unverified_developer store No verified publisher badge; developer name 'wspd' opaque; free-ish TLD .store with no business verification.
• low_install_count store Only 19 installs; limited blast radius today but suspicious WhatsApp CRM claims with 334 JS files.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk in isolation.
• storage low Standard extension storage; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles; moderate risk, enables user tracking.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; content scripts can read/modify all WA messages.

Pillar Scores

Bookkeeping