Is My Hero Academia Anime Wallpaper safe?
My Hero Academia Anime Wallpaper sends Chrome top-sites URLs to Google's favicon service on the new tab page.
The extension replaces Chrome's new tab page and asks the browser for the user's top sites. It displays up to 10 of those sites and builds each icon URL with the full site URL in a request to www.google.com/s2/favicons.
Who publishes itcoolthemestores.com - no other listings under this identity
coolthemestores.com - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab page sends your top visited sites to Google's favicon service
We observed that opening the extension's new tab page and expanding the Most Visited widget sends the full URL of each of your top 10 most-visited sites to Google's favicon endpoint, embedded in the request's domain parameter.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new tab and expand the Most Visited widget.
The extension overrides Chrome's new tab page.
The extension requests a Google favicon image for each of your top 10 most-visited sites.
Each request carries the full site URL in the image request's domain parameter.
Returned a favicon image for chatgpt.com. Observed during dynamic analysis alongside six further requests, one per top-visited site rendered in the widget, including facebook.com, youtube.com, and x.com.
Where the top-site URL gets attached to the Google request
Background worker exposes topSites to the page
MyS891HeRo763MEabg.jschrome.runtime.onMessage.addListener(function (message, sender, sendResponse) { if (message.topSites) { chrome.topSites.get(function (topSites) { sendResponse(topSites); }); return true; // keep the message channel open for the async response }});New tab widget builds the favicon request URL
js/mostvisited.jsfunction loadMostVisited() { chrome.runtime.sendMessage({ topSites: true }, function (topSites) { let count = 0; if (topSites != null) { for (let i = 0; i < topSites.length && count < 10; i++) { const site = topSites[i]; // The full top-site URL is URL-encoded and appended to Google's favicon endpoint const faviconUrl = "https://www.google.com/s2/favicons?domain=" + encodeURIComponent(site.url); $("#topsites_menu").append($("<hr>")); $("#topsites_menu").append( $('<li><a href="' + site.url + '"><i style="background-image:url(\'' + faviconUrl + '\');background-size:cover;"></i>' + site.title + '</a></li>') ); count++; } } });}loadMostVisited();- www.google.com
Receives each top-visited-site URL in the domain query parameter of a favicon image request, operated by Google/Alphabet.
What it can do
Permissions this extension asks for, as declared in version 10.21.121.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read the sites you visit most
topSites
Store an unlimited amount of data in your browser
unlimitedStorage
Store data in your browser
storage
Run searches with your default search engine
search
Where it sends data
Destinations our analysis observed My Hero Academia Anime Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.com/s2/faviconswidely used
My Hero Academia Anime Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.