Top Risks

• Privacy policy is Google's own policy (not extension-scoped); admits data collection and 3rd-party sharing — worst-case privacy disclosure.
• Uninstall and install URL hijack flags set; install redirect targets web.whatsapp.com (hijack confirmed).
• WhatsApp brand impersonation by unverified developer on extensao.store domain.
• 10 external JS hosts on wascript.com.br / watools.com.br; no CSP — remote code risk over broad WhatsApp session access.
• function_constructor + innerHTML sink without CSP creates XSS/code-injection risk inside WhatsApp Web session.

Evidence

• privacy_policy_generic_google store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, not scoped to WATHOR; scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• external_hosts_no_csp crx 10 distinct wascript.com.br/watools.com.br hosts in js_external_hosts; csp_present=false on MV3 extension.
• function_constructor crx new Function() constructor detected in bundled JS — dynamic code execution risk.
• dom_sink_innerhtml crx innerHTML assigned from variable without CSP; DOM-XSS sink inside WhatsApp Web content script.
• reputation_no_verified_publisher store verified_publisher=false, is_featured=false, 15 installs, no rating; developer email on .store TLD.
• webstore_uninstall_install_hijack store Install/uninstall hijack boosts webstore risk score per rubric (+3.0 uninstall + +2.0 install).

Permissions Breakdown

• unlimitedStorage low Local storage quota expansion; low exfil risk alone.
• storage low Standard local key-value storage.
• alarms low Scheduling only, no data access.
• tabs medium Can read tab URLs and titles; moderate privacy surface.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read/manipulate chats.

Pillar Scores

Bookkeeping