Top Risks

• Uninstall URL hijack AND install redirect to web.whatsapp.com — classic monetization/tracking shell pattern.
• Privacy policy is Google's own policy (not scoped to this extension) — admits data collection & 3rd-party sharing without extension scope.
• WhatsApp brand impersonation: developer domain extensao.store is not a Meta/WhatsApp entity.
• 10+ distinct external JS hosts (wascript.com.br, watools.com.br) contacted from a WhatsApp CRM with no CSP — broad exfil surface.
• function_constructor + innerHTML DOM-sink with no CSP present — elevated code execution risk.

Evidence

• uninstall_url_hijack + install_url_hijack manifest Both install and uninstall URL hijacks set; install redirects to https://web.whatsapp.com — monetization/tracking shell pattern.
• privacy_policy_generic_google crx Policy URL is Google's account privacy page; scope_extension=false, data_collection=true, third_party_sharing=true — D clause applies: +10.0.
• brand_impersonation_whatsapp store brand_mention.is_impersonation=true for WhatsApp; developer domain extensao.store is not Meta-owned.
• js_external_hosts_broad crx 11 distinct external hosts across wascript.com.br and watools.com.br subdomains contacted from WhatsApp content script.
• csp_absent_mv3 manifest content_security_policy is null; no CSP declared, amplifying innerHTML and function_constructor risks.
• function_constructor crx new Function() detected in bundled JS — +2.5 code quality penalty (debugger_attach/function_constructor bucket).
• developer_identity_weak store Developer name 'ewdht' is opaque; not verified publisher, not featured; domain extensao.store (.store TLD).
• 334_js_files_whatsapp_crm crx 334 JS files in a WhatsApp CRM with no CSP and multiple external API backends — very large attack surface.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low direct data-exfil risk alone.
• storage low Standard key-value storage; low risk.
• alarms low Scheduling API; low risk.
• tabs medium Can read tab URLs and titles across sessions.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; permits reading chat content.

Pillar Scores

Bookkeeping