Top Risks

• Uninstall AND install URL hijack: redirects to web.whatsapp.com on install, unknown exfil on uninstall.
• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation: developer domain extensao.store is not affiliated with Meta/WhatsApp.
• 10 external wascript.com.br / watools.com.br endpoints contacted; broad backend surface for a 45-install CRM.
• No CSP + function_constructor + innerHTML sink: XSS escalation risk on WhatsApp Web page content.

Evidence

• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — install hijack confirmed.
• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() called; target null but hook present.
• brand_impersonation store brand_mention whatsapp; developer domain extensao.store, confirmed_owner=false, is_impersonation=true.
• generic_privacy_policy store Policy URL is Google Account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_hosts crx 10 distinct wascript.com.br / watools.com.br JS host endpoints — large backend surface for 45-install ext.
• no_csp manifest content_security_policy null; MV3 default applies but no explicit restriction; function_constructor present.
• code_quality_function_constructor crx new Function() in content script on WhatsApp Web — arbitrary code execution vector.
• install_perm_anomaly api 45 installs, unverified dev, WhatsApp impersonation, 334 JS files — disproportionate footprint.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low direct harm but enables large local data accumulation.
• storage low Standard extension storage; low risk on its own.
• alarms low Scheduling only; no data access.
• tabs medium Can read tab URLs and titles; limited to active context but exposes browsing metadata.
• https://web.whatsapp.com/* medium Content access to WhatsApp Web — chat messages, contacts visible to injected scripts.

Pillar Scores

Bookkeeping