Is Online Weather Forecast safe?

Medium risk

Online Weather Forecast sends typed new-tab search queries to transitschedules.net before search submission.

Online Weather Forecast replaces the new tab page with search and weather features. As you type in either new-tab search box, the extension requests autosuggest results from transitschedules.net using the current search text before you submit the search. On first load it also fetches pixel markup from transitschedules.net and injects the returned HTML into the page.

Online Weather Forecastv2.0.4Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab searches sent to autosuggest before submission

When you type in either search box on the Online Weather Forecast new-tab page, the extension sends the text to transitschedules.net for autosuggest before Enter or click.

Dynamic analysis confirmed this; both boxes build the same URL.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You type into a search box on the extension's new-tab page.

This applies to both the small top search field and the larger center search field.

The extension did this

The extension sends the current search text to transitschedules.net before you submit the search.

The request is created from the live field value as the input changes.

Field sent in the autosuggest request
  • Search box text
    weather tomorrow (illustrative)

    The text you type can describe what you are looking for before you decide to run the search.

  • Autosuggest URL
    https://transitschedules.net/extension/public/autosuggest?q=weather%20tomorrow (illustrative)

    The search text is placed in the web address sent to the suggestion service.

Captured request
GEThttps://transitschedules.net/extension/public/autosuggest?q=cws-static-query-204

Dynamic analysis confirmed a GET request to the autosuggest endpoint while typing, before search submission.

The code that does this

Both new-tab search boxes send live input to the same autosuggest endpoint

Readable version

Top search: readable control flow

static/js/main.cf2f9690.chunk.js
useEffect(() => {  fetchTopSuggestions();}, [searchText]);function fetchTopSuggestions() {  countTop = 0;  if (searchText.length !== 0) {    $.getJSON(      "https://transitschedules.net/extension/public/autosuggest?q=" + encodeURIComponent(searchText),      response => {        if (!response.toString().includes("Server Error:")) {          if (response.gossip.results.length > 0 && $("#topbarsearch").val()) {            $(".search-border1").addClass("expand-search1");          } else {            $(".search-border1").removeClass("expand-search1");          }          setTopSuggestions(response.gossip.results);        }      }    );  } else {    setTopSuggestions([]);  }}<input  id="topbarsearch"  type="search"  placeholder="Search"  onChange={event => setSearchText(event.target.value)}/>

Main search: readable control flow

static/js/main.cf2f9690.chunk.js
useEffect(() => {  count = 0;  if (searchText.length !== 0) {    axios      .get("https://transitschedules.net/extension/public/autosuggest?q=" + encodeURIComponent(searchText))      .then(response => {        const data = response.data;        if (!data.toString().includes("Server Error:")) {          if (data.gossip.results.length > 0 && $("#mainsearch").val()) {            $(".search-border").addClass("expand-search");          } else {            $(".search-border").removeClass("expand-search");          }          setMainSuggestions(data.gossip.results);        }      })      .catch(error => console.log(error));  } else {    setMainSuggestions([]);  }}, [searchText]);<input  id="mainsearch"  type="search"  placeholder="Search or type a URL"  onChange={event => setSearchText(event.target.value)}/>
External host receiving the autosuggest query
    • transitschedules.net

    Receives GET requests to /extension/public/autosuggest with the typed search text in the q query parameter.

What it can do

Permissions this extension asks for, as declared in version 2.0.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Run searches with your default search engine

    search

  • Store data in your browser

    storage

Where it sends data

Destinations our analysis observed Online Weather Forecast contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • transitschedules.net

    Online Weather Forecast sends data to transitschedules.net. One other extension we have analysed sends data here.

Updated 30 September 2026dbiiidihfliagfecijmchjmgdfgjcjhf