Top Risks

• WhatsApp impersonation: unverified gmail dev claiming WhatsApp CRM with brand_mention.is_impersonation=true.
• Free-webmail developer (ivanilopes790@gmail.com) with generic alias 'ext.user001' and no business website.
• Content script injects into web.whatsapp.com and contacts external host hc-stt.hiperchat.com.br — unknown third party.
• No CSP present (MV3 default applies) + dom_sink_innerhtml_userctrl in vendor bundle raises XSS risk.
• Install-on-open hijack redirects to web.whatsapp.com on install; low install count (47) with no ratings is a tail-attack-surface signal.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is gmail user with no confirmed ownership.
• free_webmail_developer store Developer email ivanilopes790@gmail.com + name ext.user001; no verified business website.
• install_url_hijack manifest install_url_hijack=true targeting https://web.whatsapp.com on extension install.
• external_js_hosts crx 5 external JS hosts including hc-stt.hiperchat.com.br (unknown third-party) and locize.com.
• dom_xss_sink crx dom_sink_innerhtml_userctrl in vendor.BaH-a-x7.js; no CSP present to mitigate.
• no_csp manifest content_security_policy=null; csp_present=false on MV3 extension.
• privacy_policy_opt_api store Privacy policy on opt-api.com; third_party_sharing=true but scope and retention are declared.
• very_low_installs store Only 47 installs, 0 ratings; no established trust signal; tail-attack-surface scenario.

Permissions Breakdown

• unlimitedStorage low Local storage quota only; no data exfiltration by itself.
• storage low Standard key-value local/sync storage; minimal risk.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• alarms low Background scheduling only; no data access.
• content_scripts:https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read/modify messages and DOM.

Pillar Scores

Bookkeeping