Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and 3rd-party sharing.
• Uninstall and install URL hijack both active; install redirects to web.whatsapp.com obscuring intent.
• WhatsApp brand impersonation by unverified developer on extensao.store domain.
• 10+ external wascript.com.br/watools.com.br endpoints contacted — large exfil surface against WhatsApp session.
• function_constructor (new Function) in content script executing inside WhatsApp Web context.

Evidence

• privacy_policy_google_generic store Privacy URL points to Google's own policy (myaccount.google.com); scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy.
• uninstall_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com → +3.0+2.0 Webstore.
• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer not confirmed owner → +2.0 Reputation.
• js_external_hosts crx 10 distinct wascript.com.br/watools.com.br subdomains in js_external_hosts; >3 distinct domains → +1.5 Network.
• function_constructor crx new Function() constructor found in content script — maps to +2.5 code_quality (debugger_attach/function_constructor tier).
• dom_sink_innerhtml_userctrl_no_csp crx innerHTML sink present AND csp_present=false → elevated to +2.0 code_quality per FIX B.
• no_csp_mv3 manifest content_security_policy=null; MV3 has strict default but no explicit CSP declared for content scripts.
• low_installs_unknown_dev store Only 19 installs; developer 'whscl' with email on extensao.store; not verified publisher.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; limited direct harm but enables large data caching.
• storage low Standard local/sync storage; low standalone risk.
• alarms low Scheduling alarms; low risk but enables persistent background activity.
• tabs medium Can read tab URLs and titles across all open tabs; moderate privacy risk.
• https://web.whatsapp.com/* medium Content access scoped to WhatsApp Web only; can read/modify chat messages.

Pillar Scores

Bookkeeping