Is Anime Girl Wallpaper New Tab safe?

Low risk

Anime Girl Wallpaper New Tab sends shortcut URLs to Google and adds an affiliate tag to Amazon navigations.

When its new-tab page renders shortcuts, the extension requests favicons from Google's service with each shortcut URL in the query string. Amazon shortcut and search navigations are modified before opening so they include a hidden affiliate tag.

dealalchemistv2023.5.7.452Chrome Web Store
20Risk
Who publishes it

dealalchemist - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
dealalchemist

Same store account

2 other listings published from this account, 6k+ users between them, none of them carrying a finding.

Mclaren Wallpaper New Tab4k+LowMercedes-Benz Wallpaper New Tab2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Shortcut URLs Sent to Google on Every New Tab

Opening a new tab requests an icon for each shortcut tile from Google's favicon service, sending its full URL to www.google.com.

Covers default shortcuts (Google, Gmail, Amazon, YouTube, Reddit, Netflix, Outlook, ChatGPT) plus any you add.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab.

This extension's chrome_url_overrides setting replaces Chrome's default new-tab page with its own start page.

The extension did this

It requests an icon for each shortcut from Google's favicon service, sending the shortcut's full URL as a query parameter.

This happens automatically for every shortcut tile shown on the page, including any you add yourself.

What's sent to Google on every new tab
  • Each default shortcut's URL
    https://mail.google.com/

    The address of every pinned shortcut (Amazon, Gmail, Outlook, etc.) is sent to Google as part of the icon request, each new tab.

  • Custom shortcuts you add
    https://outlook.office365.com/

    If you add your own shortcut, such as a work portal or personal site, that URL is sent to Google the same way.

Captured request
GEThttps://www.google.com/s2/favicons?sz=128&domain_url=https://www.amazon.com

200 OK, favicon image (PNG)

The code that does this

widgets/shortcuts/Favorite.tsx, the favicon image source

Readable version

Favorite.tsx (from the extension's bundled source map)

widgets/shortcuts/Favorite.tsx
function Favorite({ url, title, position, onDelete, onEdit }: { url: string, title: string, position: number, onDelete: Function, onEdit: Function }) {    const nozama = useBuildConfigStore((state) => state.nozama);    return (        <Grid item >            <FavoriteButton href={nozama_creation(url, nozama)} variant="text" color="inherit" >                <div style={                    {                        textAlign: "center",                        alignItems: "center",                        display: "flex",                        flexDirection: "column",                        paddingTop: '10px',                    }}>                    <EditFavoriteModal position={position} onDelete={onDelete} onEdit={onEdit} url={url} title={title}/>                    <div style={{ objectFit: "contain", width: "48px", height: "48px", backgroundColor: "rgba(32, 33, 36, 1)", borderRadius: "50%", }}>                        <img style={{ width: "24px", height: "24px", padding: "12px" }}                            src={url.includes('newtabthemebuilder.com') ? 'SearchEngineFavicon/NewTabThemeBuilderIcon.png' : `https://www.google.com/s2/favicons?sz=128&domain_url=${url}`} />                    </div>                    <Typography variant="caption" style={{ paddingTop: "10px", textTransform: "none", width: "100%" }}>{title.substring(0, 13)}</Typography>                </div>            </FavoriteButton >        </Grid>    );}
Where shortcut URLs are sent
    • www.google.com

    Google's favicon endpoint (s2/favicons). Receives the URL of every shortcut tile on the new-tab page as domain_url, on each new tab.

Amazon Shortcut Adds an Encoded Affiliate Tag Before Navigation

Clicking the Amazon shortcut, or picking Amazon from the search dropdown, appends an Associates tag (tag=fromnewtab0e-20) and tracking params before navigating.

Params are split, reversed, and shifted in code, decoded at click time.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

You click the extension's built-in Amazon shortcut, or choose Amazon from the search-engine dropdown and submit a search.

The extension did this

It appends an Amazon Associates affiliate tag and related tracking parameters to the Amazon URL before your browser navigates.

The parameters are decoded from two obfuscated strings at the moment you click, and are skipped only if the URL already contains a tag parameter.

Why you can't catch this in DevTools

The affiliate parameters aren't stored as plain, readable text anywhere in the extension's shipped code. They're split into two constants, reversed, and each character shifted 3 positions in the ASCII table, then decoded and appended to the URL at the moment you click.

Decoded value
&_encoding=UTF8&tag=fromnewtab0e-20&linkCode=ur2&linkId=03d0944a27e4a9153c57383debfdc383&camp=1789&creative=9325
The code that does this

utils/nozama_creation.tsx + utils/MakeMeLaugh.tsx, the affiliate-tag decoder

Readable version

nozama_creation.tsx (from the extension's bundled source map)

utils/nozama_creation.tsx
import { rofl } from "./MakeMeLaugh";export function nozama_creation(url: string, user: string) {    if (url.includes('nozama'.split('').reverse().join('')) && !url.includes('tag')) {         const nozama_str_1 = ')bhqfrglqj@XWI;)wdj@iurpqhzwde3h053)olqnFrgh';        const nozama_str_2 = '@xu5)olqnLg@36g3<77d5:h7d<486f8:6;6gheigf6;6)fdps@4:;<)fuhdwlyh@<658';        const nozama_base = [nozama_str_1+nozama_str_2, nozama_str_1+nozama_str_2];        const nozama = rofl(user).includes('tag')            ? [...nozama_base, user]            : nozama_base;        const randomIndex = Math.floor(Math.random() * nozama.length);        const random = rofl(nozama[randomIndex]);        if( url.includes("?")){            return (url.concat(random))        }        return (url.concat('?' + random))    } else {        return url    }}

MakeMeLaugh.tsx — the character-shift decoder

utils/MakeMeLaugh.tsx
export function rofl(str: string) {    let result = "";    for (let i = 0; i < str.length; i++) {      let charCode = str.charCodeAt(i);      // Shift each character back by 3 positions in the ASCII table      charCode = (charCode - 3 + 256) % 256;      result += String.fromCharCode(charCode);    }    return result;  }
Captured request
GEThttps://www.amazon.com/?&_encoding=UTF8&tag=fromnewtab0e-20&linkCode=ur2&linkId=03d0944a27e4a9153c57383debfdc383&camp=1789&creative=9325

200 OK, Amazon storefront

Where the affiliate tag is sent
    • www.amazon.com

    Receives an Associates tag (tag=fromnewtab0e-20) and link params when the Amazon shortcut or search option is used, crediting purchases to that account.

Reproduce it yourself

Decodes the extension's rot-3 encoded affiliate-tag strings the same way the extension does internally, so you can verify the tag values yourself without installing the extension.

Requires
  • Node.js 18+
rofl-decode.js · js
// rofl-decode.js// Decodes the extension's affiliate-tag strings the same way// utils/MakeMeLaugh.tsx (rofl) and utils/nozama_creation.tsx do internally.function rofl(str) {  let result = "";  for (let i = 0; i < str.length; i++) {    let charCode = str.charCodeAt(i);    // Shift each character back by 3 positions in the ASCII table    charCode = (charCode - 3 + 256) % 256;    result += String.fromCharCode(charCode);  }  return result;}// The two encoded constants shipped in utils/nozama_creation.tsxconst nozama_str_1 = ")bhqfrglqj@XWI;)wdj@iurpqhzwde3h053)olqnFrgh";const nozama_str_2 = "@xu5)olqnLg@36g3<77d5:h7d<486f8:6;6gheigf6;6)fdps@4:;<)fuhdwlyh@<658";const decoded = rofl(nozama_str_1 + nozama_str_2);console.log("Decoded affiliate parameters:", decoded);
How to run it
  1. 1node rofl-decode.js

Where it sends data

Destinations our analysis observed Anime Girl Wallpaper New Tab contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Anime Girl Wallpaper New Tab sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

  • www.amazon.com

    Anime Girl Wallpaper New Tab sends data to www.amazon.com. 4 other extensions we have analysed send data here.

Updated 30 September 2026kjbbpfdmimckkfhmkkihnmlelmpofbaf