Top Risks

• Privacy policy is Google's own policy — not scoped to this extension; admits data collection and third-party sharing (→ +10 privacy).
• Uninstall and install URL hijack flags set; install redirects to web.whatsapp.com (hijack pattern present).
• WhatsApp brand impersonation: brand_mention.is_impersonation=true, developer is unverified (extensao.store ≠ whatsapp.com).
• 10 external wascript.com.br / watools.com.br JS hosts contacted; no CSP on MV3; broad backend surface for a tiny 8-install app.
• function_constructor (new Function) and innerHTML user-controlled DOM sink found in 334 JS files — code execution risk without CSP.

Evidence

• privacy_policy_generic_google store Privacy URL points to Google's own policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10 privacy.
• uninstall_and_install_url_hijack crx uninstall_url_hijack=true; install_url_hijack=true targeting https://web.whatsapp.com → +3.0+2.0 webstore.
• whatsapp_impersonation store brand_mention.is_impersonation=true; developer domain extensao.store is not whatsapp.com; not verified → +2.0 reputation.
• external_js_hosts_10plus crx 10 distinct wascript.com.br/watools.com.br endpoints in js_external_hosts; >3 distinct domains → +1.5 network.
• no_csp_mv3 manifest csp_present=false on MV3; dom_sink_innerhtml present without CSP guard → +2.0 code quality (FIX B).
• function_constructor_finding crx new Function() constructor detected in JS → +2.5 code quality (debugger_attach/function_constructor tier).
• no_verified_publisher store verified_publisher=false, not featured; developer name 'Stfl' with generic .store domain TLD.
• very_low_installs store Only 8 installs; large external backend surface (10 hosts, 334 JS files) disproportionate to user base.

Permissions Breakdown

• unlimitedStorage low Allows unlimited local storage; low risk alone but enables large data caching.
• storage low Standard local extension storage.
• alarms low Scheduling alarms; low standalone risk.
• tabs medium Can read tab URLs and titles; medium risk for a WhatsApp CRM.
• https://web.whatsapp.com/* medium Scoped host access to WhatsApp Web; can read all messages and contacts displayed.

Pillar Scores

Bookkeeping