Is BTS Kpop Wallpaper safe?

Medium risk

BTS Kpop Wallpaper is medium risk. Every time you open a new tab, the extension asks Chrome for your most-visited sites, then requests a favicon from Google for each one with the full site URL in the query string. We captured these requests reaching Google in live traffic.

coolthemestores.comv10.08.252.45Chrome Web Store
45Risk
Who publishes it

coolthemestores.com - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
coolthemestores.com
Website
coolthemestores.com/contact-us

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab page sends your top-site URLs to Google's favicon service

Every time you open a new tab, the extension asks Chrome for your most-visited sites, then requests a favicon from Google for each one with the full site URL in the query string.

We captured these requests reaching Google in live traffic.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

The extension has registered itself as the new-tab page in the manifest.

The extension did this

The page fetches your Chrome top-sites list, then asks Google for a favicon for each one by putting the full site URL in the request's query string.

This happens automatically, with no click or setting required.

What's in the outbound request
  • Top-site URL
    https://www.youtube.com/

    The full address of a site you visit often, taken from Chrome's most-visited list and placed in a query parameter sent to Google.

  • Number of sites per page load
    10

    Up to ten of your top sites are sent this way on a single new-tab page load.

Captured request
GEThttps://www.google.com/s2/favicons?domain=https%3A%2F%2Fwww.youtube.com%2F

Google's favicon CDN returns a small icon image; the site URL is not needed for this response, only for Google's own logging.

The code that does this

The favicon request is built from your top sites

Readable version

Readable equivalent

function renderMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function(topSites) {    let shown = 0;    if (topSites != null) {      for (let i = 0; i < topSites.length && shown < 10; i++, shown++) {        const faviconUrl = 'https://www.google.com/s2/favicons?domain=' + encodeURIComponent(topSites[i].url);        $('#topsites_menu').append(          $('<li><a href="' + topSites[i].url + '"><i style="background-image:url(\'' + faviconUrl + '\');background-size:cover;"></i>' + topSites[i].title + '</a></li>')        );      }    }  });}renderMostVisited();
Where the request goes
    • www.google.com

    Google's favicon-fetching endpoint (s2/favicons). Operated by Google LLC. Receives the full URL of each of your top sites as a query parameter on every new-tab page load.

What it can do

Permissions this extension asks for, as declared in version 10.08.252.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Updated 30 September 2026plfjjfppeejfbicljieldfkighmapjpp