Is Weather Forecast safe?
Weather Forecast loads HTML and links from linangdata.com into its popup and opens server-chosen tabs.
When the popup opens, the extension requests content from linangdata.com and writes the responses directly into the popup page. Clicking those injected links opens the server-chosen URLs in new browser tabs, so the destinations are controlled remotely rather than by the extension.
Who publishes itLinangData - 18 other listings from the same operator, 4 of them carrying a finding
LinangData - 18 other listings from the same operator, 4 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
18 other listings published from this account, 235k+ users between them. 4 of them carry a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Weather Forecast popup shows HTML and opens tab links supplied by linangdata.com
Code analysis shows the popup inserts HTML from linangdata.com into its page and opens the links in that HTML in new tabs, so the server decides what appears and where clicks go.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Static analysis
You open the weather popup from the toolbar.
It loads HTML from linangdata.com and shows it in the popup.
Clicking a link in that HTML opens the server-chosen address in a new tab.
Popup script fetches remote HTML and opens its links
Same code, no obfuscation present
app.js $.get( "https://linangdata.com/servedcontent/dynamiclinks.php?source=weather", function( data ) { $( "#links" ).html( data ); $(".navopentab").unbind().on("click", function(e){ e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({url:link}); }) }); $.get( "https://linangdata.com/servedcontent/bannertop.php?source=weather", function( data ) { if (data) { $( "#banner-top" ).html( data ).removeClass('hidden'); } $(".navopentab").unbind().on("click", function(e){ e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({url:link}); }) }); $.get( "https://linangdata.com/servedcontent/bannerbottom.php?source=weather", function( data ) { if (data) { $( "#banner-bottom" ).html( data ).removeClass('hidden'); } $(".navopentab").unbind().on("click", function(e){ e.preventDefault(); var link = $(this).attr('href'); chrome.tabs.create({url:link}); }) });- linangdata.com
Serves dynamiclinks.php, bannertop.php and bannerbottom.php; response HTML is inserted into the popup.
- Link destinationschrome.tabs.create({url: href})
The href values in the returned markup become the tab URL on click.
- Popup markup$('#banner-top').html(data)
Links, images and banners shown in the popup come from the server response.
Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.
What it can do
Permissions this extension asks for, as declared in version 1.0.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read your physical location
geolocation
Store data in your browser
storage
Schedule its own background tasks
alarms
Where it sends data
Destinations our analysis observed Weather contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- linangdata.comwidely used
Weather sends data to linangdata.com. A widely used service: 28 other extensions we have analysed send data here.