Top Risks

• Uninstall URL hijack flagged — extension redirects user on uninstall to third-party.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection and 3rd-party sharing.
• WhatsApp brand impersonation by unverified developer 'wty' (extensao.store).
• 10 external JS hosts under wascript.com.br/watools.com.br — large backend surface for a 30-install CRM.
• function_constructor (new Function()) in 4 files and innerHTML DOM-XSS sink with no CSP.

Evidence

• uninstall_url_hijack manifest chrome.runtime.setUninstallURL() present — +3.0 Webstore per rubric.
• install_url_hijack manifest onInstalled opens https://web.whatsapp.com — +2.0 Webstore.
• privacy_policy_generic store Policy URL is Google account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 Privacy (v3.5 D).
• brand_impersonation store WhatsApp brand mentioned; developer not confirmed owner; is_impersonation=true → +2.0 Reputation.
• external_hosts_count crx 10 distinct wascript.com.br/watools.com.br backend hosts; >3 registrable domains → +1.5 Network.
• function_constructor_no_csp crx new Function() in 4 files + no CSP → +2.5 Code Quality (debugger_attach tier).
• dom_sink_no_csp crx innerHTML from variable + csp_present=false → +2.0 Code Quality (FIX B).
• developer_identity store Developer 'wty' — short alias name, not verified publisher, email on extensao.store (992-day-old domain, 59 certs).

Permissions Breakdown

• unlimitedStorage low Local storage expansion — low standalone risk for a CRM tool.
• storage low Standard local data persistence.
• alarms low Scheduling — low risk.
• tabs medium Can read tab URLs and titles; moderate risk if misused.
• host_permission: https://web.whatsapp.com/* medium Content access on WhatsApp Web — narrow scope but sensitive (messages, contacts).

Pillar Scores

Bookkeeping