Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — Chatweb CRM : Transforme seu whatsapp em um sistema de vendas [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and third-party sharing (privacy pillar maxed).
• Uninstall and install URL hijack both flagged; install redirect to web.whatsapp.com and uninstall telemetry to unknown target.
• WhatsApp brand impersonation: developer domain extensao.store is not confirmed Meta/WhatsApp owner.
• 10 distinct external wascript.com.br / watools.com.br backend hosts contacted — broad exfiltration surface for WhatsApp message data.

Evidence

• privacy_policy_generic store Policy URL is Google's own privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() present; target null but hook confirmed → +3 webstore.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com → +2 webstore.
• brand_impersonation store WhatsApp brand mentioned; confirmed_owner=false, is_impersonation=true, not verified/featured → +2 reputation.
• external_hosts_broad crx 10 wascript.com.br / watools.com.br hosts in js_external_hosts; all external to dev domain extensao.store.
• code_function_constructor crx new Function() in production JS bundle; treated as debugger_attach-tier capability → +2.5 code quality.
• dom_sink_no_csp crx innerHTML userctrl sink + csp_present=false triggers FIX B → +2.0 code quality.
• reputation_weak_developer store Developer name 'ewdht' is opaque alias; no verified publisher badge; floored at 7.5 per impersonation floor rule.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — Chatweb CRM : Transforme seu whatsapp em um sistema de vendas [adware] + malext.io malicious_extension_sentry; score 3.85 -> 6.35 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local storage; low direct harm but enables data hoarding.
• storage low Standard local key-value store; low risk alone.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles across all tabs; moderate privacy risk.
• https://web.whatsapp.com/* medium Host access to WhatsApp Web; can read/modify all messages and contacts visible there.

Pillar Scores

Bookkeeping