Top Risks

• WhatsApp impersonation: unverified gmail dev claiming WhatsApp brand affiliation; confirmed is_impersonation=true.
• Content script on web.whatsapp.com can read/mutate all WhatsApp Web DOM including private messages.
• No CSP + innerHTML DOM sink in vendor bundle creates DOM-XSS attack surface for message data.
• Privacy policy hosted on opt-api.com (third-party domain), admits data collection and third-party sharing.
• install_url_hijack opens web.whatsapp.com on install; obfuscates extension's own identity.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true; WhatsApp mentioned but dev is gmail user ext.user002, not Meta.
• free_webmail_dev_no_business store Developer email gomesjaildo3@gmail.com; developer_name ext.user002; no verified publisher.
• content_script_whatsapp manifest content_scripts injected into https://web.whatsapp.com/* — full DOM access to private messages.
• no_csp manifest content_security_policy is null; csp_present=false on MV3 extension.
• dom_xss_sink crx innerHTML assignment in vendor.BaH-a-x7.js with no CSP; DOM-XSS risk elevated per FIX B.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com; misdirection tactic.
• privacy_policy_third_party store Policy at opt-api.com (not dev domain); scope_extension=true, third_party_sharing=true, retention=true.
• external_js_hosts crx JS contacts hc-stt.hiperchat.com.br, locize.com, reactjs.org, web.whatsapp.com, www.i18next.com.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; no direct data exfil risk alone.
• storage low Standard local storage for extension state.
• tabs medium Can read tab URLs and titles; moderate info-disclosure risk.
• alarms low Schedules background tasks; low inherent risk.
• content_scripts: https://web.whatsapp.com/* medium Injects JS into WhatsApp Web; can read DOM including messages.

Pillar Scores

Bookkeeping