Is Kuromi Wallpaper safe?
Kuromi Wallpaper sends top visited site URLs to Google's favicon service on the new-tab page.
When the extension's new-tab page loads, it reads the browser's top visited sites to build a most-visited menu. For each entry, it requests a favicon from Google using the visited site's URL in the request query.
Who publishes itKDDA - no other listings under this identity, 1 shared hostname
KDDA - no other listings under this identity, 1 shared hostname
What this publisher told the store about itself, and the other listings that told it the same thing.
Shared hosts - 1 hostname
Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Kuromi Wallpaper's new tab page sends your top-visited URLs to Google
Every time you open a new tab and reveal the Most Visited menu, the extension requests a Google favicon for each top site, embedding the full page URL.
Dynamic analysis confirmed planted history URLs went out verbatim.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new tab, then open the extension's Most Visited menu.
Chrome must already have topSites entries from your normal browsing.
The extension reads your browser's top sites and requests a Google favicon for each one, embedding the full page URL in the request.
This happens for up to 10 entries, all from a single menu open.
- Full URL of a top-visited sitehttps://en.wikipedia.org/wiki/Sriracha_sauce (illustrative)
The exact page address you visited, not just the site's domain, is sent to Google.
- Number of sites per menu open10
Up to 10 of your most-visited pages are sent in one batch every time the menu is opened.
200 OK, favicon image
Reading topSites and building the favicon request URL
Background message handler (renamed)
dragonballz671bg.jschrome.runtime.onMessage.addListener(function (message, sender, sendResponse) { if (message.topSites) { chrome.topSites.get(function (topSites) { sendResponse(topSites); }); return true; // keep the message channel open for the async response }});New-tab page renders Most Visited menu (renamed)
js/mostvisited.jsfunction renderMostVisitedMenu() { chrome.runtime.sendMessage({ topSites: true }, function (topSites) { let renderedCount = 0; if (topSites == null) return; console.log("topsites", topSites.length); for (let i = 0; i < topSites.length && renderedCount < 10; i++) { const site = topSites[i]; const faviconUrl = "https://www.google.com/s2/favicons?domain=" + encodeURIComponent(site.url); // full visited URL, not just the hostname $("#topsites_menu").append($("<hr>")); $("#topsites_menu").append( $( `<li><a href="${site.url}">` + `<i style="background-image:url('${faviconUrl}');background-size:cover;"></i>` + `${site.title}</a></li>` ) ); renderedCount++; } });}// Runs immediately when the new-tab page loads.renderMostVisitedMenu();- www.google.com
Receives a favicon-image request for every top-visited site, with the full visited page URL embedded in the domain= query parameter.
What it can do
Permissions this extension asks for, as declared in version 0.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Store data in your browser
storage
Read the sites you visit most
topSites
Where it sends data
Destinations our analysis observed Kuromi Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.com/s2/faviconswidely used
Kuromi Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.