Top Risks

• Privacy policy is Google's generic policy — does not describe this extension's data practices at all (scores +10.0).
• Brand impersonation: extension uses 'WhatsApp' branding with no verified ownership; is_impersonation=true.
• Uninstall URL hijack and install URL hijack both flagged, indicating aggressive lifecycle monetization.
• 10 distinct external JS hosts under wascript.com.br / watools.com.br contacted — broad backend surface with no CSP.
• function_constructor (new Function()) found in content-script running inside WhatsApp Web session.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store not confirmed owner.
• generic_privacy_policy store Privacy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true => +10.0.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br endpoints in js_external_hosts; no CSP to restrict them.
• function_constructor crx new Function() in content/assets/js/...193.js — dynamic code execution inside WhatsApp Web context.
• no_csp manifest content_security_policy is null; MV3 default applies but extension contacts many remote hosts without CSP.
• reputation_no_verified_publisher store verified_publisher=false, is_featured_by_google=false, 30 installs only, developer Intzp unknown.
• dom_xss_sink crx innerHTML assigned from variable in content script with no CSP; DOM-XSS risk in WhatsApp Web page context.

Permissions Breakdown

• unlimitedStorage low Allows large local storage; minor risk on its own.
• storage low Standard local extension storage.
• alarms low Schedules background tasks; minimal standalone risk.
• tabs medium Can read tab URLs and titles across sessions.
• https://web.whatsapp.com/* medium Scoped host permission; enables content-script injection into WhatsApp Web.

Pillar Scores

Bookkeeping