Top Risks

• Uninstall URL hijack detected — classic monetization/tracking shell pattern.
• Privacy policy is Google's own policy (not extension-scoped), admitted data collection + 3rd-party sharing → +10 privacy.
• WhatsApp brand impersonation by unverified developer 'ewdht' at extensao.store.
• 10 external wascript.com.br / watools.com.br hosts contacted; no CSP — broad server-side reach over WhatsApp session.
• function_constructor (new Function) + innerHTML DOM-XSS sink with no CSP raises code quality risk.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set — classic monetization/tracking shell signal (+3.0 Webstore).
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br hosts; extension phones home to external backend with WhatsApp session access.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk (+2.5 Code Quality).
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable with no CSP present → elevated to +2.0 per FIX B.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack (+2.0 Webstore).
• no_csp manifest csp_present=false on MV3; amplifies DOM-XSS and function_constructor risks.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low risk on its own.
• storage low Standard local data persistence.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles; moderate fingerprinting risk.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web; reads/modifies WhatsApp DOM and messages.

Pillar Scores

Bookkeeping