Is Nature Extension safe?
Nature Extension sends precise geolocation to OpenWeatherMap and top-site hostnames to Google's favicon service.
When its new-tab weather widget initializes and refreshes hourly, it reads browser geolocation and requests OpenWeatherMap weather data with latitude and longitude. It also reads Chrome's top sites and loads each site's favicon through Google's favicon endpoint, which sends those hostnames to Google.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab page sends your top-site hostnames to Google's favicon service
Opening a new tab makes the extension read your Chrome top-sites list, then request each site's icon from Google, disclosing that site's hostname.
We observed 6 outbound requests carrying real top-site domains during dynamic analysis.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new browser tab.
Chrome loads the extension's new-tab override page instead of Chrome's default new-tab page.
The extension reads your Chrome top-sites list and requests each site's icon from Google, disclosing that site's hostname.
One GET request per top-site tile is sent to www.google.com/s2/favicons, each carrying that site's hostname in the URL.
- Top-site hostnamefacebook.com
The domain of a site you visit often enough for Chrome to rank it among your top sites.
- Number of top sites disclosed6 hostnames
Every tile shown on the new-tab page fires its own request, so your whole top-sites list is disclosed at once.
200 OK, PNG favicon image. The hostname has already left the device in the request URL by the time this response arrives; five further requests fired the same way for chatgpt.com, chatgot.com, www.youtube.com, x.com, and chrome.google.com.
Building the favicon request from Chrome's top-sites list
// Builds the favicon URL for one top siteconst buildFaviconUrl = (topSite) => `https://www.google.com/s2/favicons?sz=48&domain_url=${new URL(topSite.url).hostname}`;// Renders one <img> per top site, src = buildFaviconUrl(topSite)const TopSitesWidget = ({ topSites }) => topSites.length === 0 ? null : topSites.map((site) => React.createElement("img", { src: buildFaviconUrl(site), alt: site.title, }), );// Fetches Chrome's top-sites list, falling back to a hardcoded// list of popular sites if chrome.topSites is unavailableconst getTopSites = (callback) => { if (self.chrome && chrome.topSites) { return chrome.topSites.get(callback); } callback([ { title: "Gmail", url: "https://mail.google.com/" }, { title: "Facebook", url: "https://www.facebook.com/" }, // ...remaining fallback entries ]);};// On new-tab init: fetch top sites, render the widgetconst initTopSitesWidget = () => new Promise((resolve) => { getTopSites((topSites) => { render( React.createElement(TopSitesWidget, { topSites }), document.getElementById("top-sites-widget-root"), resolve, ); }); });- www.google.com
Receives the hostname of each Chrome top site once per new tab, via the s2/favicons icon-fetching endpoint.
What it can do
Permissions this extension asks for, as declared in version 1.2.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on api.openweathermap.org
https://api.openweathermap.org/data/2.5/*
Store data in your browser
storage
Read your physical location
geolocation
Read the sites you visit most
topSites
Where it sends data
Destinations our analysis observed Nature Extension contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.comwidely used
Nature Extension sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.
- api.openweathermap.orgwidely used
Nature Extension sends data to api.openweathermap.org. A widely used service: 32 other extensions we have analysed send data here.