Is Dragon Wallpaper safe?

Medium risk

Dragon Wallpaper sends up to 10 Chrome top-site URLs to Google's favicon service on its new-tab page.

When its new-tab page opens, Dragon Wallpaper reads Chrome's top-sites list and displays entries in a Most Visited menu. For each displayed site, it builds a Google favicon request containing the visited site's URL, sending up to 10 top-site URLs to Google.

gianna.lanav3.36.3.45Chrome Web Store
45Risk
Who publishes it

gianna.lana - 1 other listing from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
gianna.lana

Same store account

1 other listing published from this account, 2k+ users between them, none of them carrying a finding.

Bunny & Rabbit Wallpaper2k+Low

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab page sends your visited site URLs to Google's favicon service

Every time you open a new tab, the extension reads your Chrome Top Sites list and requests a favicon for each entry from Google, placing the full URL you visited in the request.

This happens automatically and without a prompt.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You browse to a few different websites, then open a new browser tab.

Chrome's own Top Sites list already tracks these visits for its default new-tab page.

The extension did this

The extension's new-tab page reads that list and sends each site's full URL to Google's favicon service.

Up to 10 of your most-visited URLs are sent this way every time the new-tab page renders.

The code that does this

New-tab page turns your Top Sites list into favicon requests

Readable version

Renders the Most Visited menu

js/mostvisited.js
function renderMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function (topSites) {    let count = 0;    if (topSites != null) {      for (let i = 0; i < topSites.length && count < 10; i++) {        const site = topSites[i];        $("#topsites_menu").append($("<hr>"));        $("#topsites_menu").append(          $(            `<li><a href="${site.url}">` +            `<i style="background-image:url('https://www.google.com/s2/favicons?domain=${encodeURIComponent(site.url)}');background-size:cover;"></i>` +            `${site.title}</a></li>`          )        );        count++;      }    }  });}renderMostVisited();

Background service worker handler

DraGoN_343PaPeRbg.js
chrome.runtime.onMessage.addListener(function (message, sender, sendResponse) {  if (message.topSites) {    chrome.topSites.get(function (topSites) {      sendResponse(topSites);    });    return true;  }});
Captured request
GEThttps://www.google.com/s2/favicons?domain=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FSpecial%3ARandom

200 OK, returns the favicon image for the visited site. A second, identical request pattern was captured for the just-visited amazon.com URL in the same session.

What each favicon request reveals
  • Visited site address
    https://en.wikipedia.org/wiki/Special:Random

    The exact page you visited, taken from Chrome's built-in Top Sites list.

  • Sites sent per new tab
    Up to 10

    How many of your recently visited sites get sent every time you open a new tab.

  • Saved shortcut address
    https://sensitive.example/path (illustrative)

    Code analysis shows shortcuts you save on the new-tab page are sent the same way; this path was not captured in this test session.

Where your visited URLs go
    • google.com

    Receives the full visited-site URL in the domain query parameter of a favicon lookup. Operated by Google (Alphabet).

What it can do

Permissions this extension asks for, as declared in version 3.36.3.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Dragon Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.com/s2/faviconswidely used

    Dragon Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.

Updated 30 September 2026ejklolckikibefoiefcfjchpkkknmdjb