Top Risks

• NewTab override + 36 months stale = persistent reach with no recent security review.
• Privacy policy fetched but not scoped to this extension; admits data collection and third-party sharing → Privacy pillar 10.0.
• Free-webmail developer (weathertabpro@gmail.com) with no verified business identity.
• Uninstall URL hijack present — tracks/redirects users on removal.
• cookies permission paired with newtab override gives broad session-level capability across all sites.

Evidence

• newtab_override manifest chrome_url_overrides.newtab set; replaces every new tab page permanently.
• uninstall_url_hijack manifest uninstall_url_hijack=true; extension phones home or redirects on removal.
• stale_extension store Last updated September 2023; 36 months since update — maintenance score 10.0.
• free_webmail_dev store Developer email weathertabpro@gmail.com; no verified business domain.
• privacy_policy_unscoped api Policy fetched but scope_extension=false, data_collection=true, third_party_sharing=true → D-clause +10.0.
• cookies_permission manifest cookies permission declared; high risk combined with newtab override.
• is_featured_by_google store Featured badge present; partial reputation credit but not verified publisher.
• tail_attack_surface api install_perm_anomaly.tail_attack_surface=true; small install base with high-tier permissions.

Permissions Breakdown

• alarms low Schedules weather refresh; minimal risk.
• cookies high Full cookie read/write; high risk when paired with newtab override.
• topSites medium Exposes user's most visited sites; privacy surface.
• storage low Local data persistence; standard.
• tabs medium Tab URL/title access across browser; broad browsing visibility.
• chrome_url_overrides.newtab high Replaces new tab — persistent reach on every new tab open.
• *://*.weathertab-api.info/* medium Scoped host permission to dev-controlled domain; limited but unverified domain.

Pillar Scores

Bookkeeping