Top Risks

• Privacy policy is Google's generic policy — not scoped to this extension; classified as data_collection+third_party_sharing without extension scope.
• Uninstall URL hijack and install URL hijack detected — classic monetization/tracking shell pattern.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10 distinct external JS hosts (wascript.com.br, watools.com.br) contacted by extension with no CSP; remote code risk.
• function_constructor (new Function) usage in content script running on WhatsApp Web — arbitrary code execution surface.

Evidence

• uninstall_url_hijack + install_url_hijack crx Both onInstall and uninstall URL hooks set to third-party targets; +3.0+2.0 webstore.
• privacy_policy_generic_google store Policy URL is myaccount.google.com generic policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (D).
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true, confirmed_owner=false, not verified publisher → +2.0 reputation.
• js_external_hosts_10_domains crx 10 distinct wascript.com.br / watools.com.br endpoints; no CSP; >3 distinct registrable domains → +1.5 network.
• no_csp_mv3 manifest csp_present=false on MV3; dom_sink_innerhtml_userctrl escalated to +2.0 per FIX B.
• function_constructor_code_finding crx new Function() constructor detected in content script on WhatsApp Web → +2.5 code quality.
• unverified_developer_no_featured store verified_publisher=false, is_featured_by_google=false, developer extensao.store not recognized org.
• operator_cluster_no_siblings api sibling_count=0; no cluster amplifier applied.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low direct harm potential.
• storage low Standard local key-value storage; no cross-site risk.
• alarms low Scheduling API; low risk alone.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; matches stated CRM function but enables message interception.

Pillar Scores

Bookkeeping