Are there cryptographical flaws in this e2ee website chat widget?
If the customer sends his public key to the business, then the business creates a new set of keys forwarding the new public key to the visitor then the business now has a way to decrypt messages from the visitor since the visitor is not aware that the public key is not the intended customers public key but the new one generated by the business.  The business now can decrypt all messages from the visitor to the business making any changes they wish and using the customers original public key to re-encrypt the changed message with the customers public key and passing that message along to the customer who is not aware that the message has been changed.  If the business does this with the public key of the visitor passed to the customer as well then messages can be read and changed in the opposite direction as well.  This is a classic man in the middle.  That is what TLS is designed for an encrypted communication channel directly between the visitor and the customer with no relay between the certificates for TLS can be verified through a certificate authority which both parties have to trust for the initial key exchange to take place.  In this scenario the business is trying to act as a trusted man in the middle however it maybe the intention to have the business act as a certificate authority  who signs both the businesses and visitors certificates or public keys to ensure that both parties are receiving the intended keys.  In order to do that both parties should have the businesses certificates installed as trusted certificates authorities on their systems which is not a great idea and can lead to major compromises in practice.