Top Risks

• Extension last updated 37 months ago; effectively abandoned with active search/newtab override.
• Privacy policy URL returns SSL error — unfetchable, treated as no policy.
• jquery@1.9.1 bundled with 3 medium CVEs (XSS); no CSP amplifies risk per v2 jquery+no-CSP rule.
• Search provider override routes queries through non-direct provider (search.logiweather.com) with ad-tech shape.
• No developer name listed; newtab+search override combo is a known monetization shell pattern.

Evidence

• search_provider_override manifest Sets default search to search.logiweather.com/8wk62F?q=...; is_direct_provider=false per probe.
• newtab_override manifest chrome_url_overrides.newtab = options.html; combined with search override = monetization shell.
• privacy_policy_unfetchable api fetch_error:SSLError on https://www.loginvest.co/privacy-policy.html; scored as no policy.
• cve_jquery_medium crx jquery@1.9.1 has CVE-2019-11358, CVE-2020-11023, CVE-2015-9251 (all medium XSS); fixed_in 3.5.0.
• no_csp_plus_vulnerable_jquery crx csp_present=false AND jquery<3.5 triggers v2 +2.0 code-quality penalty.
• zombie_extension store 37 months since last update (>36mo); zombie booster not applied (install_count unknown).
• no_developer_name store developer_name is empty string; +1.0 reputation per rubric.
• external_js_hosts crx 6 external JS hosts: api.openweathermap.org, getbootstrap.com, github.com, fontawesome x2, popper.js.org.

CVE Exposures (3)

Permissions Breakdown

• storage low Local key-value storage only; no cross-site capability.
• chrome_url_overrides.newtab medium Replaces new-tab page; monetization surface via search redirect.
• chrome_settings_overrides.search_provider medium Sets default search engine to logiweather.com, a non-direct ad-linked provider.

Pillar Scores

Bookkeeping