Is Goku Wallpaper safe?

Medium risk

Goku Wallpaper sends top-site URLs from its new-tab page to Google's favicon service.

When the new-tab page loads, Goku Wallpaper requests the browser's top sites and uses each URL to load a favicon from Google. Those favicon requests include the visited site's URL as a query value sent to Google's favicon endpoint.

winter.ninav3.41.80.45Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab page sends your top-visited site URLs to Google's favicon service

We observed the extension's new-tab page send the URLs of your top 10 most-visited sites to Google's favicon service, with each full URL embedded in an image request.

Confirmed by planting a site visit and capturing the resulting request.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

The extension's new-tab override page loads and requests your most-visited sites list.

The extension did this

It sends the URL of up to 10 of your most-visited sites to Google's favicon service.

Each URL is embedded in a favicon image request that fires as soon as the list renders.

Captured request
GEThttps://www.google.com/s2/favicons?domain=https%3A%2F%2Fwww.reddit.com%2F

Google returns a small favicon icon image. The visited site's URL has already been transmitted in the request itself regardless of the response.

The code that does this

Building the favicon request from your top sites

Readable version

js/mostvisited.js, renamed

js/mostvisited.js
function renderMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function (topSites) {    let shown = 0;    if (topSites != null) {      for (let i = 0; i < topSites.length && shown < 10; i++, shown++) {        const site = topSites[i];        const faviconUrl =          "https://www.google.com/s2/favicons?domain=" +          encodeURIComponent(site.url);        $("#topsites_menu").append($("<hr>"));        $("#topsites_menu").append(          $(            `<li><a href="${site.url}">` +            `<i style="background-image:url('${faviconUrl}');background-size:cover;"></i>` +            `${site.title}</a></li>`          )        );      }    }  });}renderMostVisited();

LoVE_921GoKubg.js, renamed

LoVE_921GoKubg.js
chrome.runtime.onMessage.addListener(function (message, sender, sendResponse) {  if (message.topSites) {    chrome.topSites.get(function (topSites) {      sendResponse(topSites);    });    return true; // keep the message channel open for the async response  }});
What the favicon request exposes
  • Visited site URL
    https://www.reddit.com/

    The full address of a site from your browsing history, including domain and path, in the request's query string.

  • Sites per new tab
    10

    This repeats for each of your top most-visited sites, up to 10, every time the list is shown.

Where the data goes
    • www.google.com

    Google's favicon icon service. Receives your visited site's URL as a query parameter on every request, though fetching an icon does not require the full URL.

What it can do

Permissions this extension asks for, as declared in version 3.41.80.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Goku Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Goku Wallpaper sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026laefemhekmempmhnffebdpdkhnnfcfai