Top Risks

• Brand impersonation: extension targets WhatsApp but developer domain is gmail.com, not Meta/WhatsApp.
• Free-webmail dev (gmail) with no developer name and no business website — unaccountable identity.
• Content script on web.whatsapp.com can read all WhatsApp messages and manipulate DOM.
• External JS hosts include hiperchat.com.br and locize.com — third-party code execution surface in WhatsApp context.
• install_url_hijack opens web.whatsapp.com on install; minor but signals low development discipline.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain is gmail.com, not verified owner.
• free_webmail_dev_no_name store developer_email=oifelipegomes7@gmail.com, developer_name empty, no business website.
• content_script_whatsapp manifest content_scripts_matches=['https://web.whatsapp.com/*'] — full DOM access to WhatsApp messages.
• external_js_hosts crx js_external_hosts include hc-stt.hiperchat.com.br and locize.com — third-party code loaded in WhatsApp context.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in vendor.BaH-a-x7.js; no CSP to mitigate; raises code quality risk.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on install.
• privacy_policy_third_party_sharing api Privacy policy discloses data collection, retention, and third-party sharing — scoped but sharing acknowledged.
• low_install_count store Only 4 installs; extension is effectively untested/unvetted in the wild.

Permissions Breakdown

• unlimitedStorage low Allows storing large data locally; low risk for a WhatsApp CRM tool.
• storage low Standard key-value storage; low risk.
• tabs medium Can read tab URLs and titles; moderate risk.
• alarms low Scheduling only; minimal risk.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify all WhatsApp messages and UI.

Pillar Scores

Bookkeeping