Is Neymar - Football Live Wallpaper safe?

Medium risk

Neymar - Football Live Wallpaper sends saved shortcut URLs to Google's favicon service when its new tab page opens.

The extension stores user-added new-tab shortcuts locally, then renders each one with a favicon loaded from Google's favicon service. When the new tab page opens, those requests include each saved shortcut URL in the favicon query parameter.

FlowTabv1.0.8Chrome Web Store
45Risk
Who publishes it

FlowTab - 2 other listings from the same operator, none carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
FlowTab

Same store account

2 other listings published from this account, 6k+ users between them, none of them carrying a finding.

Porsche 911 - Sports Car Live Wallpaper5k+CleanBlack Clover New Tab Wallpaper1k+Clean

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab shortcuts send your saved site URLs to Google's favicon service

Every time this extension's new tab opens, it asks Google's favicon service for an icon for each saved shortcut, sending that shortcut's full URL, including any site you add yourself, in the request.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a tab controlled by this extension, or add a new shortcut.

The new-tab override runs the page's script, which renders each saved shortcut as a tile.

The extension did this

The page requests a favicon image from Google for every shortcut, putting the shortcut's full URL in the request.

This happens automatically, with no prompt, each time the new tab renders.

What's stored on your device

The shortcut list rendered on the new tab. Each url becomes the value sent to Google; a shortcut you add yourself is sent the same way.

Location
localStorage key "shortcuts" on the new-tab page
Captured request
GEThttps://www.google.com/s2/favicons?domain=https://www.youtube.com&sz=48

Google returns a 48x48 favicon image. The shortcut URL has already reached Google's servers in the request itself, regardless of the response.

What the favicon request tells Google
  • Shortcut URL
    https://www.youtube.com

    The full address of a site you saved as a new-tab shortcut, including any site you add yourself.

  • Request source
    Browser GET request from the new-tab page

    Your browser makes this request, so Google also sees your IP address and browser details alongside the shortcut URL.

Where the shortcut URLs go
    • www.google.com

    Public favicon-lookup endpoint (s2/favicons). Receives the full shortcut URL in the domain query parameter on every new-tab open, with no consent prompt.

Where it sends data

Destinations our analysis observed Neymar - Football Live Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Neymar - Football Live Wallpaper sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026laafpeklcnlfmjaofbndehkjpnccbhek