Top Risks

• Privacy policy is Google's generic account policy — does not scope to this extension; data_collection+third_party_sharing admitted without extension context.
• Developer is anonymous (no name, free webmail gmail) with no verified business identity.
• Geolocation permission paired with CN/HK/SG hosted APIs sends location data to foreign infrastructure.
• No CSP on MV3 extension; extension is 17 months stale approaching high-maintenance band.
• Only 26 installs with no ratings — unverified quality signal, low accountability.

Evidence

• generic_privacy_policy store Privacy URL points to Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy (v3.5 D).
• free_webmail_dev_no_name manifest developer_email=jiangxidong@gmail.com, developer_name empty → reputation +1.5 (free webmail) +1.0 (no name).
• geolocation_to_cn_apis manifest geolocation permission + host_permissions to devapi.qweather.com/geoapi.qweather.com; host_geo_diversity CN/HK/SG.
• no_csp crx content_security_policy is null; MV3 default CSP applies but no explicit policy declared.
• stale_extension store months_since_update=17; maintenance band = 6-12mo scored +3.5.
• no_code_findings crx code_findings_raw empty, obfuscation_score=0.0; code quality = 0.0.
• no_cve_findings crx cve_findings_raw empty; CVE pillar = 0.0.
• low_install_count store Only 26 installs, 0 ratings; install_perm_anomaly flags all false.

Permissions Breakdown

• geolocation medium Accesses user's physical location; expected for weather but sensitive if exfiltrated.
• host:https://devapi.qweather.com/* medium Chinese weather API; location data sent to CN-hosted endpoint.
• host:https://geoapi.qweather.com/* medium Geo-lookup API on CN/HK/SG infrastructure; paired with geolocation permission.
• host:https://a.hecdn.net/* low CDN for weather assets; lower risk but adds geo-diversity to CN cluster.

Pillar Scores

Bookkeeping