Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — IronZap [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Uninstall URL hijack detected — classic monetization/tracking shell pattern.
• Privacy policy is Google's own policy (not extension-scoped), admitted data collection + 3rd-party sharing → +10 privacy.
• WhatsApp brand impersonation by unverified developer 'ewdht' at extensao.store.
• 10 external wascript.com.br / watools.com.br hosts contacted; no CSP — broad server-side reach over WhatsApp session.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set — classic monetization/tracking shell signal (+3.0 Webstore).
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer extensao.store is not Meta/WhatsApp.
• privacy_policy_generic store Policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br hosts; extension phones home to external backend with WhatsApp session access.
• function_constructor crx new Function() constructor found in bundled JS — dynamic code execution risk (+2.5 Code Quality).
• dom_sink_innerhtml_userctrl crx innerHTML assigned from variable with no CSP present → elevated to +2.0 per FIX B.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack (+2.0 Webstore).
• no_csp manifest csp_present=false on MV3; amplifies DOM-XSS and function_constructor risks.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — IronZap [adware] + malext.io malicious_extension_sentry; score 5.68 -> 8.18 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low risk on its own.
• storage low Standard local data persistence.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles; moderate fingerprinting risk.
• https://web.whatsapp.com/* medium Scoped to WhatsApp Web; reads/modifies WhatsApp DOM and messages.

Pillar Scores

Operator Siblings (25)

Other extensions sharing this developer's compound fingerprint:

• cellckcnenolgakggljkichbmgmbibgb
• aocojboaoklgedadlpaallelnanhcpgm
• bgnkgembgfkfjipflkniiibgcedloekn
• bjhbgbfapjofmjcoonncefneakppmkmo
• bpgbjcgkegcecddlnlckjcoddhpmekdh
• cplaeebopfpnoebkaimlibpdickcjofa
• afdhcpnimkgccfjcelgkiipidhebddjh
• abkolnpebgghiglkkdjcgjgbpnddmfmp
• gjlfpggiddcminhebiejofeglfjmleli
• gkkkdobapmhkaihggejlcdbjemfkhdgk
• gollbfedpcfodjgfjddbkfnkkfdedknn
• hcbmcbkjjklkjidikpggmmfpfklcpnmb
• hkdbocoaofpdmbbgpimdkhcafenpkikn
• iibldfhmeiipohbjlkhfgnjhcmkknffi
• ikliliinakofoiojghnipegfphmoljla
• jeicljefnlpdoblklfdephbpihhjgphf
• jkblcpmoooocmdcfjojdecccejlkicap
• jhokpeoaapahcoaigkfnienliabeaang
• jcjodbceolndbhnbljiedcanmglmhmop
• lfenojckeamfnllggndghkmfhkheiimc
• ngnffiapbonmlgijfnlcgbdomhgcmmna
• lhadifphljjldcidjbhdpfcoemhddeec
• hdagfineacponepnaljjkkgjoddgpjld
• dkgcodmnjmlmgmdlbekkcjjjidkflnal
• hpfmfjmhhkfpcedjikogphkfacokfagh

Bookkeeping