Top Risks

• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and 3rd-party sharing (+10 Privacy).
• Uninstall URL hijack flag present; install event opens web.whatsapp.com — install/uninstall hooks are suspicious for 11-install extension.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10 distinct external JS hosts (wascript.com.br, watools.com.br) contacted by extension — broad backend surface for a tiny install base.
• function_constructor (new Function()) usage in content script introduces remote-code-execution risk in WhatsApp Web context.

Evidence

• privacy_policy_generic_google store Privacy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true → +10 Privacy.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store not confirmed owner → +2 Reputation.
• uninstall_url_hijack crx uninstall_url_hijack=true → +3 Webstore (Uninstall URL hijack rule).
• install_url_hijack crx install_url_hijack=true, target=https://web.whatsapp.com → +2 Webstore (Install URL hijack rule).
• js_external_hosts_broad crx 10 distinct external hosts under wascript.com.br / watools.com.br; >3 distinct registrable domains → +1.5 Network.
• function_constructor_code crx new Function() constructor in content script → +2.5 Code Quality (function_constructor signal).
• dom_sink_innerhtml_no_csp crx innerHTML from variable with csp_present=false → +2.0 Code Quality (FIX B: dom_sink + no CSP).
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default so no +2 Network penalty, but no CSP amplifies code findings.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low risk alone.
• storage low Standard local key-value store; low risk.
• alarms low Schedule background tasks; low risk.
• tabs medium Can read tab URLs and titles; moderate info exposure.
• https://web.whatsapp.com/* medium Scoped host permission; access to WhatsApp Web messages and DOM.

Pillar Scores

Bookkeeping