Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack signals present; install redirects to web.whatsapp.com.
• 10 external wascript.com.br/watools.com.br backend hosts contacted from a 33-install CRM; opaque data pipeline.
• brand_mention impersonation (Google) with no verified publisher status.
• function_constructor usage and innerHTML sink with no CSP elevate code execution risk.

Evidence

• privacy_policy_generic store Policy URL is Google's own account policy; scope_extension=false, data_collection=true, third_party_sharing=true → scores +10.0.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; developer not confirmed owner of google brand.
• external_hosts crx 10 external wascript.com.br and watools.com.br hosts in js_external_hosts; >3 distinct registrable domains.
• no_csp crx csp_present=false on MV3 extension; compounds innerHTML and Function constructor findings.
• code_function_constructor crx new Function() constructor detected in JS bundle; +2.5 code quality risk.
• reputation_unknown_dev store Developer 'whscl' with email contato@extensao.store; no verified publisher, no featured badge, 33 installs.
• js_file_count_anomaly crx 334 JS files for a 33-install CRM is atypically large; inflated attack surface.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large data caching.
• storage low Standard extension storage access.
• alarms low Scheduling alarms; minimal risk.
• tabs medium Can read tab URLs and metadata; medium risk when combined with WhatsApp host access.
• https://web.whatsapp.com/* medium Scoped host permission to WhatsApp Web; allows content script injection and message interception.

Pillar Scores

Bookkeeping