Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: What's The Weather Extension

CRITICAL RISKRemoved from Chrome Web Store

What's The Weather Extension

ID: amnflodcllnlhjnfahgpablojaehcpia

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.1

Size

0.95 MB

Rating

1.0/5

Reviews

Users

114,014

Type

Extension

Updated

Sep 13, 2023

Publisher Contextual Analysis

Author: http://theweather-extension.comView Profile
Privacy: Privacy Policy
Help: Help Center
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: Yes
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

114,014

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Check weather report and forecast in your browser new tab. Play around with weather specific custom background in your new tab.

What's the Weather gives you an easy way for getting current & weather of different locations and garnishes your Chrome Browser new tab default looks to an attractive New tab. This is a free add-on for Chrome Browser where the primary target is getting today's weather & weekly weather according to your location easily and quickly. Also, set a background from our selective Weather images gallery powered by Unsplash in your Chrome Browser default new tab. We are actually changing your Chrome browser default new tab page. Also as an added feature : 1) Convert temperature units 2) Enter your Location 3) Set current Weather-wise Background 4) Search your desired information, image, video and others through Bing search. By clicking "Add to Chrome", I accept and agree to install "What's the Weather" and setting Chrome™ New Tab to that provided by the Microsoft Bing search service and the Privacy (https://vobis.tv/privacy-policy/) and Terms of Use (https://vobis.tv/privacy-policy/).

User Growth

Showing data from Jan 01, 2022 to Dec 31, 2022

Versions

-0.86%(-987 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 2 ratings

Average Rating

Current: 1.00 / 5.0+1.00

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical0

High4

Medium2

Low0

Versions scanned

Showing 1 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0 Code review	6

Extension Version	Code Review Findings
1.0	6

Files with findings

3 distinct paths — top paths by unique finding count:

custom.js4
background.js1
ga.js1

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	high	custom.js (line 1146)	Values pulled from the remote weather API response (weatherReport.main.temp, daily.main.temp, temp_min, temp_max) are passed through eval(). A compromised or malicious API response could return a string that triggers …	1.0
2	Code Injection	high	custom.js (line 1194)	Unsanitized strings from the remote weather API (daily.weather[0].icon, description, img URL) are concatenated into HTML and written via innerHTML. A compromised or hostile response from api.browsertech.co can inject …	1.0
3	Network Interception	high	custom.js (line 2268)	The extension fetches a server-controlled 'redirection_url' template from api.browsertech.co at load time and, when the user submits a search from the new-tab page, substitutes the keyword into that template and navig…	1.0
4	Unauthorized Data Collection	high	custom.js (line 2221)	Every keystroke typed into the new-tab search box is sent in real time to the remote endpoint api.browsertech.co/my-weather/ via the 'get_suggestions' method. This exfiltrates user search terms (which commonly contain…	1.0
5	Remote Code Loading	medium	ga.js (line 1)	The bundle ships a legacy Google Analytics loader that dynamically injects a remote script (ssl.google-analytics.com/ga.js) into the document. Although landing.html currently comments out its inclusion, the file is st…	1.0
6	Tracking	medium	background.js (line 27)	On install, the background service worker POSTs to the remote api.browsertech.co endpoint so the server can (a) trigger opening a 'thankyou' tab and (b) register an uninstall-survey URL. Install events are reported to…	1.0

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


www.w3.org	/1999/02/22-rdf-syntax-ns	http://www.w3.org/1999/02/22-rdf-syntax-ns#
ns.adobe.com	/xap/1.0/	http://ns.adobe.com/xap/1.0/
purl.org	/dc/elements/1.1/	http://purl.org/dc/elements/1.1/
ns.adobe.com	/photoshop/1.0/	http://ns.adobe.com/photoshop/1.0/
ns.adobe.com	/xap/1.0/mm/	http://ns.adobe.com/xap/1.0/mm/
ns.adobe.com	/xap/1.0/sType/ResourceEvent	http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
ns.adobe.com	/xap/1.0/sType/ResourceRef	http://ns.adobe.com/xap/1.0/sType/ResourceRef#
clients2.google.com	/service/update2/crx	https://clients2.google.com/service/update2/crx
theweather-extension.com	-	https://theweather-extension.com

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

No IP addresses found

1.0 out of 5 · 1 most recent review

Text reviews

Positive

Negative

It is not a real extension, it is a website!

Ida Murray·21 Dec 2022

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

What's The Weather Extension

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions6

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating