Top Risks

• WhatsApp brand impersonation by unverified developer; confirmed_owner=false.
• Privacy policy is a generic Google URL that failed to fetch (SSLError) — no extension-scoped policy.
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com (click-fraud/tracking vector).
• 10 external backend hosts under wascript.com.br/watools.com.br contacted by extension with no CSP; broad exfil surface.
• function_constructor and innerHTML-userctrl code findings with no CSP amplify DOM-XSS and code-injection risk.

Evidence

• brand_impersonation store brand_mention.is_impersonation=true for 'whatsapp'; developer domain extensao.store is not Meta/WhatsApp.
• install_url_hijack manifest install_url_hijack=true, target=https://web.whatsapp.com; uninstall_url_hijack=true.
• external_hosts crx 10 distinct wascript.com.br/watools.com.br backend hosts in js_external_hosts; no CSP to restrict them.
• privacy_policy_fetch_failed api Privacy policy URL points to Google account page; fetch failed SSLError; not extension-scoped.
• function_constructor crx new Function() constructor found in bundled JS; no CSP present to mitigate code injection.
• dom_xss_sink crx innerHTML assigned from variable in content script running on WhatsApp Web; DOM-XSS risk.
• no_csp manifest content_security_policy=null; MV3 default applies but no explicit restriction on eval or remote scripts.
• very_low_installs store Only 2 installs; unverified developer 'Intzp'; no reputation signals available.

Permissions Breakdown

• unlimitedStorage low Allows unbounded local storage; low standalone risk.
• storage low Standard key-value extension storage.
• alarms low Schedule background tasks; low risk.
• tabs medium Can read tab URLs and titles; moderate information exposure.
• https://web.whatsapp.com/* medium Host permission scoped to WhatsApp Web; grants content-script access to all chat data.

Pillar Scores

Bookkeeping