ension tag","meaning":"This can associate the search redirect with this extension's traffic source.","severity":"context","sampleValue":"ext=weather2"},{"icon":"version","label":"Version tag","meaning":"This adds the routed search flow's version label to the destination URL.","severity":"context","sampleValue":"v=0.0.1"},{"icon":"external_link","label":"Alternate search URL","meaning":"This is the URL the JavaScript handler builds before adding the query text.","severity":"context","sampleValue":"https://searchpage.com/?ext=weather2&v=0.0.1&keywords=weather"}],"caption":"Search-routing fields in the shipped page","technicalNote":"The q parameter comes from input#searchbox name=q in index.html. The keywords parameter comes from appOpenWeather.js webSearch(), which reads $('#searchbox').val() into color and concatenates it onto the supplied URL before chrome.tabs.update()."},{"url":"https://search.loky.ch/search","kind":"network_capture","method":"GET","technicalNote":"Dynamic interaction attempts did not capture live traffic because the page navigated away before #searchbox could be submitted. The method and URL come from the shipped form element: action=https://search.loky.ch/search? and method=GET.","responseSummary":"The shipped form defines this GET navigation; no request body is used for the search submission."},{"url":"https://searchpage.com/?ext=weather2&v=0.0.1&keywords=","kind":"network_capture","method":"GET","technicalNote":"appOpenWeather.js binds #submitt to webSearch(\"https://searchpage.com/?ext=weather2&v=0.0.1&keywords=\"). webSearch() concatenates the search box value and navigates the current tab with chrome.tabs.update({url: myNewUrl}).","responseSummary":"The shipped JavaScript defines this GET navigation base; the query text is appended to the keywords parameter."},{"kind":"code_compare","caption":"The shipped new-tab form and alternate search redirect path","shipped":[{"code":"

\n \n

","caption":"New-tab form posts searches to search.loky.ch","sourceFile":"index.html"},{"code":"$29","caption":"Button handler builds a searchpage.com redirect URL","sourceFile":"js/appOpenWeather.js"}],"language":"js","deobfuscated":[{"code":"

\n \n

","caption":"New-tab form posts searches to search.loky.ch","sourceFile":"index.html"},{"code":"$2a","caption":"Button handler builds a searchpage.com redirect URL","sourceFile":"js/appOpenWeather.js"}],"technicalNote":"The deobfuscated tree is functionally identical for these excerpts. The alternate #submitt path is present in JavaScript, but index.html in this version does not include an element with id=submitt, so the primary reachable path is the form submission to search.loky.ch."},{"kind":"third_party_list","hosts":[{"host":"search.loky.ch","purpose":"Receives the normal new-tab search form submission with the query in the q parameter."},{"host":"searchpage.com","purpose":"Appears in the bundled JavaScript as an alternate search redirect destination with extension and version tags."},{"host":"weather-forecast.live","purpose":"Appears in the same JavaScript handler as a second alternate search redirect base."}],"caption":"Third-party search destinations in the claim"}],"scaleMetrics":[{"label":"Users affected","value_label":"300,000 installs","fill":1,"tier":"warning"},{"label":"Trigger frequency","value_label":"When a new-tab search is submitted","fill":0.35,"tier":"warning"},{"label":"Data exposed","value_label":"Search terms in URL parameters","fill":0.45,"tier":"warning"},{"label":"Destinations","value_label":"2 third-party search hosts","fill":0.5,"tier":"wa

Is karma Nature safe?

Findings