Is Drop Tab safe?

Medium risk

Drop Tab sends weather location lookups to geoiplookup.io and droptab.net, and adds install IDs to new-tab searches.

Drop Tab's default new-tab weather widget contacts json.geoiplookup.io to infer your location from your IP address, then sends the approximate coordinates to droptab.net for weather data. Searches from the new-tab page use the configured search URL and append a persistent extension user ID, install timing metadata, and click ID to the search query URL.

https://droptab.net/v1.0.7Chrome Web Store
49Risk
Who publishes it

https://droptab.net/ - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
https://droptab.net/
Website
droptab.net/#contact

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Drop Tab forwards IP-derived location to droptab.net for weather

Opening Drop Tab's new-tab page triggers an IP-based location lookup via json.geoiplookup.io, then sends the resulting coordinates to droptab.net's weather API.

We observed this fire automatically on first load.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open Drop Tab's replacement new-tab page with the default weather widget enabled.

The extension did this

The extension looks up your location from your IP address, then forwards the resulting coordinates to droptab.net to fetch a forecast.

Data involved in the lookup
  • Your IP address
    203.0.113.42 (illustrative)

    Your public IP address is sent to a third-party geolocation service, which uses it to estimate where you are browsing from.

  • Your IP-derived location
    51.5072, -0.1276 (illustrative)

    The estimated latitude and longitude from the IP lookup are forwarded to droptab.net to fetch weather for that area.

Captured request
GEThttps://json.geoiplookup.io/

Returns the caller's approximate latitude and longitude derived from its IP address.

Captured request
GEThttps://droptab.net/api/weather.php

Returns forecast data for the submitted coordinates, which the extension caches in chrome.storage.local for 24 hours.

Where the data goes
    • json.geoiplookup.io

    Third-party IP geolocation service. Receives your public IP address and returns an estimated latitude and longitude.

    • droptab.net

    Drop Tab's own backend. Receives the IP-derived coordinates to serve the weather forecast shown in the new-tab widget.

New-tab searches add extension identifiers to each query URL

When you search from Drop Tab's new-tab page, it redirects the query to www.google.com/search.

The URL includes your search terms plus a persistent user ID, install week and year, title tag, and click ID from extension storage.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Searches from the Drop Tab new-tab page

The extension did this

Redirects the search URL with the query plus stored extension identifiers and install metadata

Captured request
GEThttps://www.google.com/search
Fields in the request
  • Your search query
    weather tomorrow (illustrative)

    The terms typed into the new-tab search box are included in the navigation URL.

  • Stored extension identifiers
    d7f3a1b2-... (illustrative)

    A persistent extension user ID and click ID can associate searches with the same extension install.

  • Search request URL
    https://www.google.com/search?q=weather&e_uid=d7f3a1b2-... (illustrative)

    The destination URL combines the query with extension metadata before navigation.

What it can do

Permissions this extension asks for, as declared in version 1.0.7. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on droptab.net

    *://droptab.net/*

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Drop contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Drop sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

  • json.geoiplookup.io

    Drop sends data to json.geoiplookup.io. 5 other extensions we have analysed send data here.

  • droptab.net

    Drop sends data to droptab.net. No other extension we have analysed sends data here.

Updated 30 September 2026oeajaijmjcddabpejfadlfodogflaapm