Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall URL hijack detected; extension redirects browser on removal.
• WhatsApp brand impersonation: developer does not own WhatsApp, confirmed non-owner.
• 10 external JS hosts (wascript.com.br, watools.com.br) contacted — broad backend surface for a CRM with 57 installs.
• function_constructor (new Function) found in bundled JS; no CSP to mitigate code injection.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL() set — triggers 3rd-party redirect on uninstall.
• brand_impersonation store WhatsApp brand mentioned; developer domain extensao.store is not affiliated with Meta/WhatsApp.
• generic_privacy_policy store Privacy policy URL is Google's account policy; scope_extension=false, data_collection=true, third_party_sharing=true.
• broad_external_hosts crx 10 distinct wascript.com.br / watools.com.br subdomains contacted — large backend surface for 57-install CRM.
• function_constructor crx new Function() constructor detected; no CSP present to constrain dynamic code execution.
• dom_sink_innerhtml crx innerHTML assigned from variable with no CSP — DOM-XSS risk on WhatsApp Web content.
• install_url_hijack crx onInstalled opens https://web.whatsapp.com — low-severity redirect but hijack pattern present.
• no_csp manifest content_security_policy is null; no CSP protections for MV3 extension with dynamic code findings.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct harm but enables large data caching.
• storage low Standard local key-value store; low risk in isolation.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles across all open tabs.
• https://web.whatsapp.com/* medium Host access scoped to WhatsApp Web; can read/modify chat content and messages.

Pillar Scores

Bookkeeping