Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; collects and shares data with third parties.
• Brand impersonation: uses 'whatsapp' branding, dev domain extensao.store is not affiliated with Meta.
• Uninstall URL hijack detected — onUninstall redirects user to third-party URL.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted; no CSP to constrain them.
• new Function() constructor present alongside no CSP — dynamic code execution risk on WhatsApp Web content.

Evidence

• brand_impersonation store brand_mention.is_impersonation==true for 'whatsapp'; dev domain extensao.store not confirmed owner.
• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() to third party detected per uninstall_url_hijack=true.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — low severity but confirms hook pattern.
• external_js_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains contacted; no CSP to restrict remote fetches.
• function_constructor crx new Function() found in JS bundle; dynamic code execution capability with no CSP guard.
• dom_sink_innerhtml_userctrl crx innerHTML sink from variable in content script running on web.whatsapp.com; XSS risk on chat data.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit hardening declared.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but can cache large data.
• storage low Standard local storage access; low risk in isolation.
• alarms low Scheduled background tasks; minimal risk alone.
• tabs medium Can read tab URLs and titles; moderate privacy exposure.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; enables content script on sensitive chat data.

Pillar Scores

Bookkeeping