Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; collects and shares data with third parties per policy text.
• Uninstall URL hijack flag set; extension hooks uninstall event for potential tracking.
• WhatsApp brand impersonation by unverified developer 'wty' on extensao.store domain.
• 10 external JS hosts under wascript.com.br/watools.com.br contacted at runtime with no CSP — remote code risk.
• function_constructor (new Function) and innerHTML DOM-XSS sink found in 334-file JS bundle with no CSP.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for WhatsApp; developer is not Meta/WhatsApp; unverified.
• privacy_policy_generic store Policy URL is Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true.
• uninstall_url_hijack crx uninstall_url_hijack=true; extension registers uninstall URL handler.
• install_url_hijack crx install_url_hijack=true; onInstalled opens https://web.whatsapp.com.
• external_js_hosts crx 10 distinct wascript.com.br/watools.com.br endpoints; no CSP — extension can load/communicate with remote servers.
• function_constructor crx new Function() detected in bundle — dynamic code execution risk without CSP protection.
• dom_xss_sink crx innerHTML from variable in content script running on WhatsApp Web — DOM-XSS risk against message content.
• no_csp manifest content_security_policy is null; MV3 default applies but no explicit script-src restriction declared.

Permissions Breakdown

• unlimitedStorage low Local storage expansion; low direct harm but enables large local data accumulation.
• storage low Standard extension key-value storage; low risk in isolation.
• alarms low Scheduling API; low risk, used for periodic tasks.
• tabs medium Can read tab URLs and titles across browser; moderate privacy risk.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read all messages/DOM on that origin.

Pillar Scores

Bookkeeping