Top Risks

• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing; scores max privacy risk.
• Uninstall and install URL hijack flags set — classic monetization/tracking shell behavior.
• WhatsApp brand impersonation: developer domain (extensao.store) is not a confirmed WhatsApp/Meta owner.
• 11 external JS hosts under wascript.com.br/watools.com.br contacted — large undisclosed backend surface on WhatsApp session.
• function_constructor (new Function) usage in content script — dynamic code execution risk against WhatsApp Web DOM.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set; classic monetization/tracking shell signal (+3.0 Webstore).
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack confirmed (+2.0 Webstore).
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not confirmed Meta/WhatsApp owner (+2.0 Reputation).
• generic_privacy_policy store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 D).
• js_external_hosts crx 10+ distinct wascript.com.br/watools.com.br endpoints contacted; >3 registrable domains (+1.5 Network).
• function_constructor crx new Function() constructor in content script — dynamic code execution (+2.5 Code Quality).
• dom_sink_innerhtml_userctrl crx innerHTML from variable without CSP present — DOM-XSS risk elevated to +2.0 (FIX B: no CSP).
• no_csp manifest MV3 with null CSP; csp_present=false amplifies code quality findings per FIX B.

Permissions Breakdown

• unlimitedStorage low Allows unrestricted local storage; low standalone risk.
• storage low Standard local storage access; low risk.
• alarms low Scheduling only; low risk.
• tabs medium Can read tab URLs and titles; moderate risk.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web only; matches stated CRM function.

Pillar Scores

Bookkeeping