Is One Piece Gear 5 Wallpaper safe?

Medium risk

One Piece Gear 5 Wallpaper sends your Chrome Top Sites URLs to Google's favicon service on each new tab.

When a new tab opens, the extension reads Chrome's Top Sites list and displays up to 10 frequently visited sites. To show favicons for those entries, it builds requests to Google's favicon service with each site URL included in the domain parameter.

isabelle.ngv9.31.2.45Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New tab page sends your most-visited site URLs to Google's favicon service

Opening a new tab makes the extension read your Chrome Top Sites list and send each site's full URL to Google's favicon service as a query parameter.

We observed six such requests, one per top-site entry, during dynamic analysis.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

Opens a new browser tab.

The extension overrides Chrome's new tab page via chrome_url_overrides.

The extension did this

Sends the full URL of each of your most-visited sites to Google's favicon service.

Every URL returned by chrome.topSites.get() is appended as the domain parameter of a favicons request.

What each favicon request discloses
  • Full URL of a frequently visited site
    http://chatgpt.com/

    Reveals the exact page you visit most, not just the site's domain.

  • Browsing history entry
    https://www.youtube.com/

    Comes directly from Chrome's Top Sites list, which is built from your browsing history.

  • Requests per new tab
    6 requests observed in one session

    Up to ten of your top sites are processed and requested this way each time you open a tab.

Captured request
GEThttps://www.google.com/s2/favicons?domain=http%3A%2F%2Fchatgpt.com%2F

Returns a favicon image. The request itself already delivered the full top-site URL to Google as the domain parameter, one request per top-site entry (chatgpt.com, youtube.com, facebook.com, x.com, chrome.google.com/webstore).

The code that does this

Building the favicon URL from a top site

Readable version

Reformatted for readability, same logic

function loadMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function(topSites) {    if (topSites == null) return;    let count = 0;    for (let i = 0; i < topSites.length && count < 10; i++, count++) {      const site = topSites[i];      const faviconUrl =        'https://www.google.com/s2/favicons?domain=' +        encodeURIComponent(site.url);      // faviconUrl is used as a CSS background-image on the tile,      // which fires the request to Google as soon as it renders.      renderTile(site.url, site.title, faviconUrl);    }  });}loadMostVisited();
Where the data goes
    • www.google.com

    Receives the full URL of each top-site entry as the domain parameter of a favicon image request, once per new tab opened.

What it can do

Permissions this extension asks for, as declared in version 9.31.2.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed One Piece Gear 5 Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.com/s2/faviconswidely used

    One Piece Gear 5 Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.

Updated 21 September 2026afnbgbhanhlcofeinofckddfojpabhcm