Is Weather Please safe?
We analyzed Weather Please version 2.11.9's actual code and gave it a 62/100 trust score. Weather features are reasonably scoped, but optional calendar…
Bottom line
Weather features are reasonably scoped, but optional calendar reading and local token storage create notable privacy and security risk.
What it can access
It replaces the new-tab page and uses location for weather, but optional calendar access reads detailed private events and stores sign-in credentials locally.[Q1][Q3][Q4][Q14]
Security weaknesses
Calendar access and refresh credentials are stored locally, so compromise of the extension’s storage could expose calendar access.[Q14]
Signs of misuse
No evidence shows misuse: data goes to selected weather, map, or calendar providers, with no developer collection or website tracking found.[Q6][Q12]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can replace the new-tab page, request geolocation, run OAuth through Chrome identity and modify headers only for OpenStreetMap tiles.
Declares new-tab override, geolocation, identity, declarativeNetRequestWithHostAccess and an OpenStreetMap tile host. — manifest.json:10-28
Which websites can it run on, and can it read or change what appears on those pages?
No evidence of this behavior was found in the reviewed package.
Defines only an extension-owned new-tab page and no content_scripts entry. — manifest.json:1-33
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
If the user connects a calendar, it reads upcoming event subjects, descriptions, locations, times and links directly from Google or Microsoft using read-only access.
Requests Google calendar.events.readonly or Microsoft Calendars.Read and maps returned event fields into local display objects. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Discloses the exact Google event fields and read-only limitation. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores settings, cached location labels, account labels and OAuth access/refresh tokens in extension localStorage; event details stay in memory.
Persists calendar account token objects and weather configuration under named localStorage keys. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
States that event details are memory-only and tokens/account metadata are local to the extension origin. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
Requests geolocation, identity and the narrow tile-host rule only. — manifest.json:13-20
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends coordinates to Open-Meteo and OpenStreetMap services and OAuth/calendar requests to Google or Microsoft; no developer-operated collection services was found.
Fetches forecast and air quality from Open-Meteo and reverse geocoding from Nominatim with latitude/longitude. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Sends tokens only to Google/Microsoft token endpoints and Bearer calendar requests only to the corresponding calendar API. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
States that the developer operates no server receiving Google or calendar data. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
No evidence of this behavior was found in the reviewed package.
Remote responses provide weather, geocoding, map or calendar data consumed by fixed packaged logic. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Opening a new tab automatically refreshes weather for the saved location; optional periodic geolocation updates run only when the user enables that setting.
Fetches weather from saved coordinates and gates periodic navigator.geolocation calls on periodicLocationUpdate. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It replaces the browser's new-tab page, which is the extension's clearly advertised core feature.
Maps chrome_url_overrides.newtab to the packaged index.html. — manifest.json:10-12
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
No evidence of this behavior was found in the reviewed package.
Minified module retains readable provider URLs, storage keys and validation schemas. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Contains standard webpack runtime code. — next/static/chunks/webpack-7e5ed365c10d79f6.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Targeted review of the application bundle found fixed module execution and no text-to-code sink. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Declares no relaxed extension content-security policy. — manifest.json:1-33
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
Requests no tabs/history permission and only a narrow OpenStreetMap tile host. — manifest.json:13-20
The packaged policy says browsing history and visited-site contents are not accessed. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
No evidence of this behavior was found in the reviewed package.
States that Google user data is not included in analytics or diagnostic reports. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Identified endpoints are weather, maps, OAuth, calendar, review/donation and user-opened support links. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Optional calendar connections store OAuth access and refresh tokens locally and use them only with the selected provider; passwords are never read. A Google client secret is publicly embedded, but user-token compromise was not demonstrated.
Uses PKCE/state with chrome.identity.launchWebAuthFlow, persists provider tokens locally and sends Bearer tokens to Google or Microsoft calendar APIs. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Google token requests include a hard-coded client_secret visible to every package recipient. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Discloses local token storage, provider-only use, disconnect deletion and absence of password access. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or capture/clipboard permissions. — manifest.json:1-33
Can a website or remote server send commands that make the extension take actions?
No evidence of this behavior was found in the reviewed package.
Declares no background worker, external messaging or native messaging. — manifest.json:1-33
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
The sole browser-page replacement is the packaged new-tab page. — manifest.json:10-12
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
A fixed declarative rule changes only the User-Agent header for OpenStreetMap image tiles so requests identify Weather Please; it cannot redirect arbitrary traffic.
Sets a fixed WeatherPlease User-Agent only for tile.openstreetmap.org image requests. — openstreetmap-tile-rules.json:1-20
Host access and rule resource are limited to the tile service. — manifest.json:18-28
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
Requests no nativeMessaging or system integration permission. — manifest.json:13-20
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
All fetched responses are parsed against fixed data schemas and rendered as application data. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
The only network-rule resource is a packaged JSON header rule. — manifest.json:21-28
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
No content scripts or externally_connectable entry exists. — manifest.json:1-33
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
No evidence of this behavior was found in the reviewed package.
Invokes navigator.geolocation on user setup and uses interactive OAuth with state and PKCE. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Discloses provider destinations, read-only scope, local storage, optional calendar use and deletion/revocation controls. — next/static/chunks/pages/privacy-6e0e7fad736393da.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Compute-heavy bundled graphics code renders the weather/new-tab experience; no mining pool, wallet or proof-of-work path exists. — next/static/chunks/pages/demo-100a4df7fba65e68.js:1
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Declares no content scripts or all-site page access. — manifest.json:1-33