Top Risks

• Privacy policy is Google's generic policy (scope_extension=false, admits data collection and third-party sharing) — +10.0 privacy pillar.
• NewTab override replaces every new tab page, granting high persistent reach to all browsing sessions.
• Dynamic script creation (script_src_dynamic) in bundled Next.js chunk; no CSP to constrain it.
• Developer name absent; only email identity provided.
• No CSP on MV3 extension with dynamic script loading — remote code injection risk not mitigated.

Evidence

• privacy_policy_generic store Policy URL is Google account policy; scope_extension=false, data_collection=true, third_party_sharing=true → +10.0 privacy.
• newtab_override manifest chrome_url_overrides.newtab = index.html; replaces every new tab for all users.
• verified_publisher_featured store verified_publisher=true AND is_featured_by_google=true; reputation floor 2.0 applied.
• script_src_dynamic crx Dynamic <script> element creation in Next.js chunk; no CSP present to restrict sources.
• no_csp manifest content_security_policy is null; MV3 provides some default but no explicit script-src hardening.
• developer_name_missing store developer_name is empty string; identity relies solely on email domain weather-please.app.
• no_bad_hosts_no_monetization api threat_intel shows empty bad_host_hits, affiliate_hits, monetization_hits; js_external_hosts only nextjs.org, react.dev.
• operator_cluster_singleton api sibling_count=0; no operator cluster risk.

Permissions Breakdown

• geolocation medium Exposes precise physical location; reasonable for weather but still sensitive.
• chrome_url_overrides.newtab medium Replaces every new-tab page; high reach, monetization surface.

Pillar Scores

Bookkeeping