Top Risks

• Uninstall URL hijack and install URL hijack detected — unsolicited redirect behavior on lifecycle events.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: extension contacts 10+ wascript.com.br/watools.com.br external hosts without disclosure.
• new Function() constructor found — potential dynamic code execution risk.
• 11 external JS hosts including several wascript.com.br subdomains create broad exfiltration surface over WhatsApp Web sessions.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() hijack detected; install_url_hijack also true, target https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• js_external_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains contacted; no CSP restricting them.
• function_constructor crx new Function() constructor found in content JS — dynamic code execution risk.
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable in content script running on WhatsApp Web — DOM-XSS sink, no CSP.
• developer_identity store Developer name 'ewdht' is opaque; no verified publisher badge; email on .store TLD.
• no_csp crx content_security_policy is null; MV3 default applies but multiple external hosts increase risk.

Permissions Breakdown

• unlimitedStorage low Allows storing large amounts of data locally; low risk alone.
• storage low Standard extension storage; low risk.
• alarms low Scheduling alarms; low risk.
• tabs medium Can read tab URLs and titles across open tabs.
• host_permissions: https://web.whatsapp.com/* medium Scoped to WhatsApp Web only; can read/modify all content on that site.

Pillar Scores

Bookkeeping