Is UV Weather safe?
We analyzed UV Weather version 2.0.66's actual code and gave it a 78/100 trust score. UV Weather has limited browser access but collects a persistent…
Bottom line
UV Weather has limited browser access but collects a persistent identifier and location-related data for analytics.
What it can access
Its permissions are limited to storing its own settings, scheduling updates, checking idle status, and optionally showing alerts. This fits a weather tool and does not grant access to websites, browser history, cookies, or files.
Signs of misuse
It sends persistent installation tracking and IP-derived location information, settings, and version details to its analytics provider. That is a privacy concern, but the evidence does not show theft of browser sessions, webpage monitoring, remote control, or manipulation of browsing.
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests local storage, scheduled/background timing, idle-state awareness, and optional notifications. Those permissions are proportionate for saving weather preferences, refreshing forecasts, and delivering alerts; it does not request access to websites or private browser records.
Declares permissions: storage, alarms, idle; optional permission: notifications. No host permissions, content scripts, tabs, history, cookies, downloads, or location permission are declared. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
No evidence was found in the manifest or package for this capability.
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence was found that the extension can read passwords, payment details, messages, or form entries. The available package information does not show content scripts or access to web pages.
The manifest declares only storage, alarms, idle, and optional notifications; it has no content_scripts, host_permissions, or tabs permission. — manifest.json:1-31
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No evidence was found in the manifest or package for this capability.
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension likely contacts external weather or service endpoints, but the source needed to identify the destinations, data sent, and purposes could not be inspected. No conclusion about the transmitted information is supported by the available evidence.
The manifest does not declare host permissions, but this alone does not establish whether extension pages make externally directed requests. — manifest.json:1-31
Does it download or run code, settings, or instructions supplied by a remote server?
The manifest does not grant page access and the extension uses a self-only script policy, but the source code was not available for tracing remote responses or dynamic execution. Therefore, this cannot be safely ruled out.
The manifest declares only local extension scripts through the extension-page CSP and does not list host permissions; this is not enough to establish what JavaScript does at runtime. — manifest.json:1-1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The manifest shows an alarm capability and a background service worker, which could support background activity, but the source code was not available to determine whether it opens pages, redirects searches, downloads files, or sends requests without a user action.
The manifest includes a background service worker and the alarms permission; runtime behavior cannot be determined from the manifest alone. — manifest.json:1-1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Some packaged behavior is difficult to inspect automatically.
This file is heavily minified into an unusually long line. — components/clickEvents.js:1
This file is heavily minified into an unusually long line. — components/daily.js:1
This file is heavily minified into an unusually long line. — components/util.js:1
This file is heavily minified into an unusually long line. — libraries/chart.umd.min.js:19
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No direct `eval(` evidence was found, but the available evidence does not fully rule out `new Function()` or string-based timers. The earlier library match is minified and cannot be safely classified without source inspection.
Does it track the websites, pages, searches, or links you visit?
No code evidence shows the extension reading or recording the websites, pages, searches, or links you visit. It does send installation, settings, version, and approximate location/IP data to its own analytics service, which is different from browsing-history tracking.
The extension requests storage, alarms, and idle permissions, but not tabs, history, webNavigation, or content-script access permissions used to monitor visited pages. — manifest.json:8-16
The Mixpanel profile payload contains installation date, app version, settings, and optionally IP; it does not contain visited URLs, page titles, searches, or links. — background.js:91-126
The extension obtains IP-based geolocation data and stores location, country, timezone, and IP-derived information for weather setup. — background.js:199-229
Does it create a persistent ID or browser fingerprint to recognize you?
The extension creates a random UUID and stores it persistently as `deviceId`. It sends that identifier to Mixpanel as the profile’s distinct ID, allowing the extension operator to recognize the installation over time; no browser-hardware fingerprinting is shown.
`mp_SetProfile` generates `deviceId = uuidv4()` and saves it in `chrome.storage.local` together with the installation time. — background.js:15-24
The generated ID is placed in Mixpanel data as `$distinct_id: deviceId`, alongside installation and configuration information. — background.js:91-110
The profile data is POSTed to `https://api.mixpanel.com/engage#profile-set`. — background.js:113-127
On later updates, the stored `deviceId` is retrieved (or migrated from `userId`) and reused as the Mixpanel `$distinct_id`. — background.js:140-155
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension sends an installation/device identifier, settings, IP address, country, and city-related data to Mixpanel and location services. I found no evidence that it reads or sends browser cookies, website sessions, login credentials, or page contents.
Builds and POSTs a Mixpanel profile containing a generated device ID, installation/version data, selected locations, and the IP address when available. — background.js:91-126
Requests the user's IP, country, city, coordinates, and timezone from geolocation.uvw.workers.dev, then stores those values and uses the IP in the analytics profile. — background.js:199-230
Uses ipinfo.io/json as a fallback to obtain the user's public IP and country. — background.js:250-257
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence shows the extension recording keystrokes, form entries, clipboard contents, or screenshots. The reviewed input handling only changes weather settings and stores those choices locally.
The change listener stores the selected language in local storage and extension storage, while color-picker callbacks store background colors; neither captures general typing, form data, clipboard contents, or screenshots. — components/setting.js:1
The code reads screen width and height for metrics, but does not capture the screen image or invoke screenshot APIs. — components/setting.js:1
Can a website or remote server send commands that make the extension take actions?
No evidence shows a website or remote server can send commands to control the extension. The reviewed background code makes outbound requests and schedules local updates, but does not expose a remotely callable command interface.
The extension initiates requests to geolocation.uvw.workers.dev and processes the returned location data; the response is used for storage and profile setup, not interpreted as commands. — background.js:187-239
The Mixpanel request sends profile data and, after completion, creates an alarm and starts a local update routine; no server-supplied action is dispatched. — background.js:124-135
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence shows the extension altering webpages, advertisements, shopping carts, referral codes, or search results. The link assignment found is for displaying a weather-alert details link inside the extension popup.
Creates an anchor in the weather-alert UI and assigns alertSevere.detailsUrl as its href, opening the alert's detailed information in a new tab; this is unrelated to webpage, shopping, advertising, referral, or search-result modification. — components/alert.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
No direct indicators were found in readable source files or the manifest.
Can it communicate with software on the computer or services running on localhost?
No direct indicators were found in readable source files or the manifest.
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence shows the extension decoding, decrypting, or unpacking hidden data and then executing or injecting it. The cited code uses ordinary media streaming and browser audio playback, while the listed decoding calls are in bundled Firebase libraries and are not shown to produce executable or injected code.
URL.createObjectURL is used to create an audio source for a MediaSource; streamed MPEG audio is appended to a SourceBuffer and played in an audio element, not executed as code or injected into a page. — components/util.js:1
The same code creates an audio element and appends it to the extension document body for text-to-speech playback; this is media handling, not hidden-code execution. — components/util.js:1
The cited fromCharCode/atob matches are bundled Firebase implementation code; no evidence was established that their output is executed or injected. — libraries/firebase-app.js:78-221
The cited atob/fromCharCode matches are bundled Firestore data/serialization routines; no evidence was established that decoded data becomes executable code or injected page content. — libraries/firebase-firestore.js:73-92
Can ordinary websites access privileged extension features through messaging or exposed files?
No source evidence shows ordinary websites can message the extension or invoke privileged actions. The manifest exposes no extension files to web pages because its web-accessible resource rules have empty origin and extension-ID allowlists.
Web-accessible resources are limited to fonts and libraries, while both "matches" and "extension_ids" are empty; no ordinary website or other extension is authorized. — manifest.json:30-41
The extension declares only storage, alarms, idle, and optional notifications permissions, with no externally connectable or content-script configuration shown. — manifest.json:9-12
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No source evidence shows suspicious behavior being selectively activated by particular websites, dates, users, or remote feature settings. The reviewed background logic uses installation state and user preferences for normal setup and analytics.
Initialization is gated by the local verUpdate value; when it is not 1 or 2, the extension performs geolocation/setup and stores verUpdate, rather than enabling suspicious behavior. — background.js:187-239
On setup, the extension creates and stores a device ID and installation timestamp. — background.js:12-25
The device ID, install date, version, preferences, and optionally IP are sent to Mixpanel for profile analytics; this is not shown as a gate for another behavior. — background.js:91-125
Updates use the stored device ID and current version to update the analytics profile and schedule periodic background updates. — background.js:140-183
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence shows the extension performing cryptocurrency mining or other hidden, sustained resource-intensive work. The flagged WebAssembly code is part of the bundled Mapbox library and is not evidence of mining by itself.
The WebAssembly call appears inside bundled Mapbox code; this alone does not demonstrate cryptocurrency mining or another hidden workload. — libraries/mapbox-gl.js:33
Does it change form fields or where a form sends its information?
No evidence shows the extension changing webpage form fields or redirecting form submissions. The reviewed field assignments only configure the extension’s own settings UI, such as color inputs and language selection.
Sets values and checked states for the extension’s settings controls, including background-color inputs, unit options, and language selection; it does not modify a webpage form action or submit a form. — components/setting.js:1
The code stores selected settings in chrome.storage.local or localStorage and reloads the extension page; no external page forms or submission destinations are referenced. — components/setting.js:1