Top Risks

• Uninstall and install URL hijack: opens/redirects to third-party on lifecycle events.
• Privacy policy is Google's generic policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer on throwaway-style domain.
• 10+ external JS hosts (wascript.com.br, watools.com.br) — large outbound attack surface for a 70-install CRM.
• function_constructor and innerHTML XSS sink found in 334-file JS bundle with no CSP.

Evidence

• install_url_hijack crx onInstalled opens https://web.whatsapp.com — install URL hijack confirmed.
• uninstall_url_hijack crx chrome.runtime.setUninstallURL() called; target not extractable but flag is true.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; dev domain extensao.store is not confirmed owner.
• generic_privacy_policy store Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true.
• external_js_hosts crx 12 distinct JS external hosts across wascript.com.br and watools.com.br subdomains.
• function_constructor crx new Function() constructor detected in JS bundle — dynamic code execution risk.
• no_csp manifest content_security_policy is null; MV3 default CSP applies but no explicit restriction on connect-src.
• low_installs_high_surface store Only 70 installs but 334 JS files and 10+ external API hosts — disproportionate attack surface.

Permissions Breakdown

• unlimitedStorage low Allows large local data storage; low standalone risk.
• storage low Standard key-value storage; low risk.
• alarms low Scheduled tasks; low risk.
• tabs medium Can read tab URLs and titles; moderate data exposure risk.
• https://web.whatsapp.com/* medium Scoped host permission; grants content access to WhatsApp Web only.

Pillar Scores

Bookkeeping