Is Minecraft Wallpaper safe?
Minecraft Wallpaper sends Chrome top-sites URLs to Google's favicon service on each new-tab page.
Minecraft Wallpaper replaces the Chrome new-tab page and reads the browser's top-sites list when that page opens. It embeds up to 10 top-site URLs into requests to Google's favicon service so the page can show site icons.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab dropdown sends your top-visited site URLs to Google's favicons
Opening the extension's new-tab dropdown sends the full URL of each of your top-visited sites to Google's favicon service.
We captured live requests carrying a Wikipedia article URL, reddit.com, bbc.com, and nytimes.com.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new tab and expand the extension's 'Most Visited' dropdown.
The extension's page replaces Chrome's default New Tab page.
The extension reads your top sites and requests a Google favicon for each one, embedding the full site URL in the request.
chrome.topSites.get supplies up to ten URLs, each appended to a google.com/s2/favicons request.
Building the favicon URL from your top-sites list (js/mostvisited.js)
function loadMostVisited() { chrome.runtime.sendMessage({ topSites: true }, function (topSites) { let count = 0; if (topSites != null) { console.log("topsites", topSites.length); for (let i = 0; i < topSites.length; i++) { const site = topSites[i]; const faviconUrl = "https://www.google.com/s2/favicons?domain=" + encodeURIComponent(site.url); $("#topsites_menu").append($("<hr>")); $("#topsites_menu").append( $( `<li><a href="${site.url}">` + `<i style="background-image:url('${faviconUrl}');background-size:cover;"></i>` + `${site.title}</a></li>` ) ); count++; if (count >= 10) break; } } });}loadMostVisited();Service worker returns your top sites on request (background script)
chrome.runtime.onMessage.addListener(function (message, sender, sendResponse) { if (message.topSites) { chrome.topSites.get(function (topSites) { sendResponse(topSites); }); return true; // keep the message channel open for the async response }});200 OK; Google returns a favicon image, unrelated to whether the extension reads the body.
- www.google.com
Google's favicon lookup service. Receives the full URL of each of your top-visited sites in the domain query parameter, up to ten per dropdown open.
The extension has no content scripts or host permissions, so this flow is new-tab-only. Favicon requests go to Google's own service, not the developer's crazycraftz.com, and chrome.topSites.get caps the list at ten sites.
What it can do
Permissions this extension asks for, as declared in version 11.2.15.38. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read the sites you visit most
topSites
Store an unlimited amount of data in your browser
unlimitedStorage
Store data in your browser
storage
Where it sends data
Destinations our analysis observed Minecraft Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.com/s2/faviconswidely used
Minecraft Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.