Is Lilo And Stitch Wallpaper safe?

Medium risk

Lilo And Stitch Wallpaper reads your top visited sites on each new tab and sends their URLs to Google's favicon service.

When the new tab page opens, the extension asks Chrome for the user's topSites list and renders up to 10 entries. For each entry, it loads a favicon from Google's service with the visited URL in the request parameter, sending those top-site URLs to Google.

jefferyyapv3.5.12.45Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Lilo & Stitch new tab wallpaper sends your top-visited site URLs to Google

Every time you open a new tab, this extension asks Chrome for your top sites, then sends each site's full URL to Google's favicon service as a query parameter.

We captured this live in a test session.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new tab in Chrome.

This extension has replaced Chrome's default new tab page with its own wallpaper page.

The extension did this

The page fetches your top-visited sites and sends each site's full URL to Google.

Each URL is attached as a query parameter on a request to Google's favicon service.

The code that does this

The new tab page builds a favicon request out of each top site's URL

Readable version

Readable equivalent

function renderMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function(topSites) {    if (topSites == null) return;    var count = 0;    for (var i = 0; i < topSites.length && count < 10; i++, count++) {      var site = topSites[i];      var faviconUrl = 'https://www.google.com/s2/favicons?domain=' + encodeURIComponent(site.url);      // renders a tile whose background-image URL embeds the visited site's full URL      $('#topsites_menu').append(        $('<li><a href="' + site.url + '"><i style="background-image:url(\'' + faviconUrl + '\');background-size:cover;"></i>' + site.title + '</a></li>')      );    }  });}renderMostVisited();
Captured request
GEThttps://www.google.com/s2/favicons?domain=https%3A%2F%2Fwww.github.com%2F

HTTP 301. Observed during dynamic analysis: 9 such requests fired in one new-tab session, each carrying a different top site's full URL, including the two sites visited immediately beforehand.

What each request to Google discloses
  • Visited site's full URL
    https://www.github.com/

    The exact address of a site you visit often, including the scheme and trailing path.

  • Site title
    GitHub

    The page title Chrome recorded for that top site, rendered locally but sourced from the same browsing history.

  • Number of sites per session
    9

    Up to 10 of your top-visited sites are disclosed each time you open a new tab.

Where the data goes
    • www.google.com

    Receives each top site's full URL as a query parameter on every favicon request, on every new tab opened.

What it can do

Permissions this extension asks for, as declared in version 3.5.12.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Lilo And Stitch Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.com/s2/faviconswidely used

    Lilo And Stitch Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.

Updated 30 September 2026jecemmokfhjfgifpgjgekkcmklgidglc