Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Botzom – Vendas, CRM e Chatbot para WhatsApp [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Operator cluster of 19 sibling extensions under same developer fingerprint — mass-deployment shell pattern.
• Privacy policy is Google's own policy (myaccount.google.com) — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack and install URL hijack both active — redirect manipulation pattern.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.

Evidence

• operator_cluster_siblings api 19 sibling extensions share same dev email, install URL, CSP host set — large operator cluster.
• privacy_policy_generic_google store Privacy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension at all.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set to 3rd-party target.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install redirect active.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store not confirmed as Meta affiliate.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints contacted; broad external network surface.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk.
• privacy_policy_classification api scope_extension=false, data_collection=true, third_party_sharing=true — worst-case generic policy.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Botzom – Vendas, CRM e Chatbot para WhatsApp [adware] + malext.io malicious_extension_sentry; score 6.27 -> 8.77 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct risk but enables large data caching.
• storage low Standard local key-value storage, minimal risk.
• alarms low Scheduling API; low risk, used for background task timing.
• tabs medium Can read tab URLs and titles; moderate risk for session awareness.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web only; matches stated function but enables message interception.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh
• okmklmkaficfbcebbggmjmphhipflhme

Bookkeeping