Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijacks detected; onInstalled redirects to web.whatsapp.com for tracking/fingerprinting.
• Brand impersonation: uses Google's privacy policy URL, brands_mentioned includes 'google', not a verified owner.
• 12 external JS hosts under wascript.com.br / watools.com.br with no CSP — broad remote code surface on WhatsApp Web.
• function_constructor (new Function) and innerHTML DOM-XSS sink in content script running on WhatsApp Web.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() set; install_url_hijack also true — onInstalled opens https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'google'; privacy policy links to myaccount.google.com — not dev-owned.
• generic_privacy_policy api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true — Google policy, not extension-specific.
• external_js_hosts crx 12 external hosts (wascript.com.br, watools.com.br subdomains) contacted; no CSP — remote code execution surface.
• function_constructor crx new Function() constructor found in content script running on WhatsApp Web — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script with no CSP — DOM-XSS sink on WhatsApp Web.
• no_csp manifest content_security_policy is null; MV3 default is strict but 12 external hosts contacted increases risk surface.
• low_install_unverified store Only 55 installs, not verified publisher, not featured; high-surface WhatsApp CRM with opaque backend infrastructure.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; minor risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling API; low standalone risk.
• tabs medium Can read tab URLs and titles; moderate privacy concern.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; enables content script injection and message interception.

Pillar Scores

Bookkeeping