Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — DragonChat [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension, admits data collection and 3rd-party sharing.
• Uninstall URL hijack and install URL hijack detected — redirects users on install/uninstall.
• 10+ external JS hosts under wascript.com.br/watools.com.br; large remote attack surface for WhatsApp data.
• function_constructor (new Function) + innerHTML DOM sink with no CSP elevates code-quality risk.

Evidence

• uninstall_url_hijack + install_url_hijack crx Extension registers both onInstalled redirect (web.whatsapp.com) and uninstall URL hijack — strong monetization/tracking pattern.
• privacy_policy_generic store Privacy policy URL is Google's own policy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 12 external JS hosts, all under wascript.com.br or watools.com.br — entire backend is third-party infrastructure.
• function_constructor crx new Function() constructor found in scanned JS; no CSP present, raising dynamic-execution risk.
• dom_sink_innerhtml_userctrl + no CSP crx innerHTML sink with user-controlled variable; csp_present=false amplifies XSS risk per FIX B.
• unverified_developer store Developer name 'wspd' is opaque alias; no verified publisher badge; email on extensao.store TLD.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack confirmed.
• host_access_whatsapp manifest Content script + host permission scoped to web.whatsapp.com — full read/write access to WhatsApp Web DOM.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — DragonChat [adware] + malext.io malicious_extension_sentry; score 5.04 -> 7.54 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone.
• storage low Standard local key-value storage access.
• alarms low Scheduling alarms; minimal risk.
• tabs medium Can read tab URLs and metadata; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/write messages in that context.

Pillar Scores

Bookkeeping