Is Naruto Wallpaper safe?
Naruto Wallpaper sends up to 10 top-site URLs from the new tab page to Google's favicon service.
When the extension's new tab page opens, it reads Chrome's top sites list and displays up to 10 entries. For each entry, it requests a favicon from Google with the visited site's URL encoded in the request, which sends those top-site URLs to Google.
Who publishes itfiona.leong - 2 other listings from the same operator, 1 of them carrying a finding
fiona.leong - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 10k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab page sends your most-visited site URLs to Google's favicon service
Every time you open a new tab, the extension reads your top 10 most-visited sites from Chrome and sends each site's full URL to Google's favicon service in a query parameter.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new tab.
The extension has overridden Chrome's new tab page.
It sends the full URL of each of your top 10 most-visited sites to Google in a favicon request.
This happens automatically, without any click or setting change.
- Full URL of a frequently visited sitehttp://facebook.com/
The complete address of a site you visit often, including scheme and path, is placed in the domain parameter of a request to Google.
- That the site is one of your top 10chrome.google.com/webstore (ranked in your top sites)
Being included at all tells Google this site is among the ones you visit most, not just a one-off page load.
Google returns the favicon image bytes for facebook.com; the extension displays it next to the site's entry in the top sites list.
Building the favicon request from your top sites
The new tab page's favicon builder, renamed for clarity
js/mostvisited.jsfunction renderTopSites() { chrome.runtime.sendMessage({ topSites: true }, function(topSites) { var addedCount = 0; if (topSites != null) { console.log("topsites", topSites.length); for (var i = 0; i < topSites.length && addedCount < 10; i++) { var site = topSites[i]; var faviconUrl = "https://www.google.com/s2/favicons?domain=" + encodeURIComponent(site.url); $("#topsites_menu").append($("<hr>")); $("#topsites_menu").append( $('<li><a href="' + site.url + '"><i style="background-image:url(\'' + faviconUrl + '\');background-size:cover;"></i>' + site.title + '</a></li>') ); addedCount++; } } });}renderTopSites();The background listener, renamed for clarity
NaR1033_RuTo89bg.jschrome.runtime.onMessage.addListener(function(message, sender, sendResponse) { if (message.topSites) { chrome.topSites.get(function(topSitesList) { sendResponse(topSitesList); }); return true; // keep the message channel open for the async response }});- www.google.com
Receives the full URL of each of your top 10 most-visited sites in the domain query parameter, used to return that site's favicon image.
Where it sends data
Destinations our analysis observed Naruto Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.comwidely used
Naruto Wallpaper sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.