Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — ohkakacjaddkccagpciddgcjjbbpcgfl [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Content script on web.whatsapp.com can read all messages/contacts; exfiltrated to multiple wascript.com.br backends.
• Uninstall and install URL hijacks present; install redirects to crm.lightiius.com/freedemo.php.
• Free-webmail dev (gmail) with no verified publisher and no developer name — low accountability.
• Privacy policy not scoped to this extension and third-party sharing undisclosed (third_party_silence=true).

Evidence

• uninstall_and_install_url_hijack manifest install_url_hijack=true (target: https://crm.lightiius.com/freedemo.php); uninstall_url_hijack=true.
• whatsapp_brand_impersonation store brand_mention.is_impersonation=true; developer domain is gmail.com, confirmed_owner=false.
• free_webmail_no_dev_name store developer_email=beto18salazar@gmail.com; developer_name empty; no verified publisher.
• privacy_policy_not_scoped api scope_extension=false, data_collection=false, third_party_silence=true — generic unscoped policy.
• multiple_external_backends crx 12 external JS hosts including bit.ly (affiliate/cloaking), 5 wascript.com.br subdomains, whatzi.cloud.
• affiliate_hit_bitly crx threat_intel.affiliate_hits: bit.ly flagged as generic short-link redirector / affiliate cloaking.
• function_constructor_code_finding crx new Function() constructor found in 326-file bundle; no CSP, raising XSS risk.
• no_csp_mv3 manifest content_security_policy=null; csp_present=false on MV3 extension with DOM-sink and Function() findings.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — ohkakacjaddkccagpciddgcjjbbpcgfl [adware] + malext.io malicious_extension_sentry; score 5.08 -> 7.58 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows large local data; low direct exfil risk.
• storage low Standard key-value storage, low risk.
• alarms low Scheduling only, no data access.
• tabs medium Can read tab URLs and titles across sessions.
• https://web.whatsapp.com/* high Content script on WhatsApp — can read all messages and contact data.
• https://*.whatzi.cloud/* medium Broad access to third-party cloud backend under unknown operator.
• https://*.wascript.com.br/* medium Broad wildcard to external BR domain; multiple subdomains contacted.

Pillar Scores

Bookkeeping