Top Risks

• THREAT FEED: extension ID independently confirmed malicious by TPCI chrome-mal-ids — WaPower [adware] + malext.io malicious_extension_sentry (+2.5, capped).
• Privacy policy is Google's own policy — not scoped to this extension; collects and shares data with third parties per policy text.
• Uninstall URL hijack flag set; extension hooks uninstall event for potential tracking.
• WhatsApp brand impersonation by unverified developer 'wty' on extensao.store domain.
• 10 external JS hosts under wascript.com.br/watools.com.br contacted at runtime with no CSP — remote code risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is not Meta/WhatsApp; unverified.
• privacy_policy_generic store Policy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers uninstall URL handler.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://web.whatsapp.com.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; no CSP — extension can load/communicate with remote servers.
• function_constructor crx new Function() detected in bundle — dynamic code execution risk without CSP protection.
• dom_xss_sink crx innerHTML from variable in content script running on WhatsApp Web — DOM-XSS risk against message content.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit script-src restriction declared.
• threat_feed_membership api Extension ID listed by TPCI chrome-mal-ids — WaPower [adware] + malext.io malicious_extension_sentry; score 3.67 -> 6.17 (+2.5 cap 2.5).

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct harm but enables large local data accumulation.
• storage low Standard extension key-value storage; low risk in isolation.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles across browser; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read all messages/DOM on that origin.

Pillar Scores

Bookkeeping