Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacking detected; install redirect to web.whatsapp.com is suspicious.
• Extension contacts 10+ external wascript.com.br / watools.com.br hosts with no CSP — broad backend surface.
• Brand impersonation: uses Google privacy policy URL but developer is not Google (confirmed_owner=false).
• function_constructor (new Function) and uncontrolled innerHTML found — code execution and XSS risk on WhatsApp Web.

Evidence

• uninstall_url_hijack manifest uninstall_url_hijack=true; redirects on uninstall — telemetry/re-engagement vector.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on install.
• brand_impersonation store brand_mention lists 'google'; confirmed_owner=false; privacy policy points to Google's own policy.
• generic_privacy_policy api Policy URL is myaccount.google.com/privacypolicy — not scoped to Vluw; admits data collection & 3rd-party sharing.
• broad_external_hosts crx 10 external wascript.com.br / watools.com.br hosts contacted; no CSP; MV3 but no content_security_policy set.
• function_constructor crx new Function() constructor in JS bundle — arbitrary code execution risk.
• dom_sink_innerhtml_userctrl crx Uncontrolled innerHTML sink on WhatsApp Web content — DOM-XSS risk without CSP.
• no_csp manifest csp_present=false with MV3; no content_security_policy declared despite remote host access.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large local data accumulation.
• storage low Standard local/sync storage access; low risk on its own.
• alarms low Scheduling alarms; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles; medium risk — exposes browsing context.
• https://web.whatsapp.com/* medium Scoped host permission; grants full content access to WhatsApp Web including messages.

Pillar Scores

Bookkeeping