Top Risks

• Privacy policy is Google's generic account policy — does not scope data collection to this extension at all.
• Uninstall URL hijack to weatherly24.com/uninstall — third-party redirect on removal.
• Developer uses free Gmail with no business name; no verified identity beyond featured badge.
• No CSP declared (MV3 default applies, but DOM innerHTML sink in popup JS is unmitigated).
• Extension contacts 4 external hosts (api.wlyapp.com, ip-api.com, reactjs.org, weatherly24.com); IP geolocation API collects user IP.

Evidence

• uninstall_url_hijack crx chrome.runtime.setUninstallURL → https://weatherly24.com/uninstall (3rd-party domain).
• privacy_policy_generic store Policy URL is myaccount.google.com/privacypolicy — Google's own policy, scope_extension=false, data_collection=true, third_party_sharing=true.
• developer_identity store developer_name empty; email hello.rafihaidari@gmail.com (free webmail). No business domain.
• dom_sink_innerhtml crx innerHTML assigned from variable in popup.100f6462.js — DOM-XSS risk with no CSP.
• external_hosts crx 4 external hosts: api.wlyapp.com, ip-api.com, reactjs.org, weatherly24.com. ip-api.com collects user IP/location.
• maintenance_stale store 15 months since last update — falls in 12–24mo band (+6.0).
• featured_badge store is_featured_by_google=true; verified_publisher=true — reduces reputation risk.
• no_csp manifest content_security_policy is null; MV3 strict default applies but no explicit policy declared.

Permissions Breakdown

• storage low Local data persistence; standard for weather prefs.
• idle low Detects user idle state; low impact for refresh scheduling.
• alarms low Scheduled background tasks; expected for periodic weather updates.

Pillar Scores

Bookkeeping