Top Risks

• Uninstall & install URL hijacks both active — classic redirect/monetization shell pattern (+3.0 Webstore each).
• Privacy policy points to Google's own policy — scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• WhatsApp brand impersonation (confirmed_owner=false) by unverified developer → Reputation +2.0.
• function_constructor (new Function) in content script running inside WhatsApp Web — code-execution risk.
• 334 JS files contacting 10 distinct wascript.com.br / watools.com.br endpoints with no CSP — broad exfil surface.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both onInstall and onUninstall URL hijacks active; classic monetization/redirect shell signal.
• privacy_policy_generic_google store PP URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to this extension; data_collection+third_party_sharing=true.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, not verified publisher.
• function_constructor crx new Function() usage in content script injected into WhatsApp Web context — dynamic code execution risk.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit CSP hardening with 334 JS files.
• js_external_hosts_count crx 10 distinct wascript.com.br / watools.com.br endpoints contacted — broad backend surface for WhatsApp data.
• reputation_no_verified_publisher store Not verified, not featured, developer domain extensao.store, only 21 installs, zero ratings.
• dom_sink_innerhtml crx innerHTML assigned from variable in content script on WhatsApp Web — DOM-XSS sink without CSP guard.

Permissions Breakdown

• unlimitedStorage low Local storage only; no direct data exfil risk alone.
• storage low Standard local key-value store.
• alarms low Scheduling only; low standalone risk.
• tabs medium Can read tab URLs/titles; moderate info exposure.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; enables content script injection into messaging context.

Pillar Scores

Bookkeeping