Is Cat wallpaper - adorable cat wallpaper safe?

Low risk

Cat wallpaper sends precise location coordinates to OpenWeatherMap for its new-tab weather widget.

When the new tab page loads and the browser permission prompt is accepted, the extension reads the device location through the geolocation API. It sends the latitude and longitude in a weather request to OpenWeatherMap, while its new-tab affiliate links are loaded from a GitHub-hosted configuration.

Tabflashv1.0Chrome Web Store
17Risk
Who publishes it

Tabflash - 4 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
Tabflash
Website
tabflash.com/en/contacts/

Same store account

4 other listings published from this account, 15k+ users between them, none of them carrying a finding.

Cristiano Ronaldo - Cristiano Ronaldo HD wallpaper6k+LowReal Madrid wallpaper - Real Madrid HD wallpaper4k+LowOne Piece Wallpaper - one piece 4k wallpaper3k+LowLionel Messi Wallpapers - high quality wallpapers2k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab shortcut links are controlled by a remote GitHub file

New-tab loads fetch a shortcut list from a JSON file on GitHub, rendered as icons: Amazon, Ebay, Temu, Gmail, Youtube.

Since the list lives outside the package, the developer can change destinations anytime without a new version or review.

Severity
Low unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

The user opens a new tab.

The extension did this

The extension fetches a link list from a file on GitHub that it does not ship in its own package and displays those links as shortcut icons.

The same file also controls the icon image shown for each shortcut.

Entries in the remote link list, as fetched during dynamic analysis
  • Amazon shortcut destination
    https://tabflash.com/amazon

    Where the Amazon icon on the new-tab page sends you when clicked.

  • Ebay shortcut destination
    https://tabflash.com/ebay

    Where the Ebay icon on the new-tab page sends you when clicked.

  • Temu shortcut destination
    https://tabflash.com/temu

    Where the Temu icon on the new-tab page sends you when clicked.

  • Gmail shortcut destination
    https://tabflash.com/gmail

    Where the Gmail icon on the new-tab page sends you when clicked.

  • Youtube shortcut destination
    https://tabflash.com/youtube

    Where the Youtube icon on the new-tab page sends you when clicked.

What's stored on your device

The extension's own cache of the remote file, written seconds after load in a fresh session, confirming a live fetch, not a leftover.

Location
chrome.storage.local, key 'affiliate_config'
Contents
{  "data": {    "affiliateLinks": [      {        "id": "amazon",        "url": "https://tabflash.com/amazon",        "icon": "https://raw.githubusercontent.com/recepock/tabflash/main/img/affiliates/amazon.png",        "name": "Amazon",        "tooltip": "Amazon"      },      {        "id": "ebay",        "url": "https://tabflash.com/ebay",        "icon": "https://raw.githubusercontent.com/recepock/tabflash/main/img/affiliates/ebay.png",        "name": "Ebay",        "tooltip": "Ebay"      },      {        "id": "temu",        "url": "https://tabflash.com/temu",        "icon": "https://raw.githubusercontent.com/recepock/tabflash/main/img/affiliates/temu.png",        "name": "Temu",        "tooltip": "Hotels"      },      {        "id": "gmail",        "url": "https://tabflash.com/gmail",        "icon": "https://raw.githubusercontent.com/recepock/tabflash/main/img/affiliates/gmail.png",        "name": "Gmail",        "tooltip": "Gmail"      },      {        "id": "youtube",        "url": "https://tabflash.com/youtube",        "icon": "https://raw.githubusercontent.com/recepock/tabflash/main/img/affiliates/youtube.png",        "name": "Youtube",        "tooltip": "Youtube"      }    ]  },  "timestamp": 1786845205409}
The code that does this

js/affiliate-manager.js fetches and renders the remote list on every new tab

Readable version
// Every new-tab load (and again every hour via setInterval in main.js),// this class fetches a JSON file from a GitHub repo the developer// controls and uses its contents directly as link destinations and// icon URLs on the new-tab page:////   1. Check a 1-hour local cache.//   2. If expired/missing, GET https://raw.githubusercontent.com/recepock/tabflash/main/config.json//   3. Cache the response in chrome.storage.local.//   4. For each entry in config.affiliateLinks: create an <a href={link.url}>//      containing an <img src={link.icon}> and append it to the page.//// Nothing in the shipped package fixes what these links point to --// the destinations and icons come entirely from the remote file.
Hosts contacted to build the new-tab shortcut row
    • raw.githubusercontent.com

    Serves config.json, listing each shortcut's URL and icon, plus the icon images. Hosted in the developer's GitHub repo (recepock/tabflash), editable anytime without a new release.

    • tabflash.com

    Destination the rendered shortcut links currently point to for Amazon, Ebay, Temu, Gmail, and Youtube; visited only if the user clicks a shortcut icon.

What it can do

Permissions this extension asks for, as declared in version 1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on api.openweathermap.org

    https://api.openweathermap.org/*

  • Store data in your browser

    storage

  • Read your physical location

    geolocation

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Cat wallpaper - adorable cat wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • api.openweathermap.orgwidely used

    Cat wallpaper - adorable cat wallpaper sends data to api.openweathermap.org. A widely used service: 32 other extensions we have analysed send data here.

  • raw.githubusercontent.comwidely used

    Cat wallpaper - adorable cat wallpaper sends data to raw.githubusercontent.com. A widely used service: 26 other extensions we have analysed send data here.

Updated 30 September 2026hlbgfjkoncdpgmgenfpjbiifagaakddj