Is Toca Life: World safe?

Medium risk

Toca Life: World sends your Chrome top-sites URLs to Google's favicon service when its new-tab page loads.

The extension replaces Chrome's new-tab page and asks Chrome for the browser's top sites. On each new-tab load, it shows up to 10 of those sites and builds favicon requests to www.google.com using the visited-site URLs in the request.

owenchuav78.31.13.45Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

New-tab page sends your top-visited sites to Google's favicon service

Every new tab you open asks Chrome for your most-visited sites, then requests an icon for each one from Google, putting the full site URL in the request to www.google.com.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open a new browser tab.

The extension did this

The extension asks Chrome for your most-visited sites, then sends each site's full URL to Google to fetch its icon.

This happens automatically, with no prompt, every time you open a new tab.

Site URLs sent to Google's favicon endpoint during one new-tab load
  • Visited site URL 1
    http://facebook.com/

    A site from your browsing history, sent to Google to fetch its icon.

  • Visited site URL 2
    http://chatgpt.com/

    A site from your browsing history, sent to Google to fetch its icon.

  • Visited site URL 3
    https://www.youtube.com/

    A site from your browsing history, sent to Google to fetch its icon.

  • Visited site URL 4
    http://x.com/

    A site from your browsing history, sent to Google to fetch its icon.

  • Visited site URL 5
    https://chrome.google.com/webstore?hl=en

    A site from your browsing history, sent to Google to fetch its icon.

  • Visited site URL 6
    http://chatgot.com/

    A site from your browsing history, sent to Google to fetch its icon.

Captured request
GEThttps://www.google.com/s2/favicons?domain=http%3A%2F%2Ffacebook.com%2F

Google returns a favicon image; no error or confirmation step is shown to you.

The code that does this

New-tab script that turns your top sites into favicon requests

Readable version

js/mostvisited.js, reformatted

js/mostvisited.js
function renderMostVisited() {  chrome.runtime.sendMessage({ topSites: true }, function (topSites) {    var count = 0;    if (topSites != null) {      for (var i = 0; i < topSites.length && count < 10; i++) {        var site = topSites[i];        var faviconUrl =          'https://www.google.com/s2/favicons?domain=' +          encodeURIComponent(site.url);        $('#topsites_menu').append($('<hr>'));        $('#topsites_menu').append(          $('<li><a href="' + site.url + '">' +            '<i style="background-image:url(\'' + faviconUrl + '\');background-size:cover;"></i>' +            site.title + '</a></li>')        );        count++;      }    }  });}renderMostVisited();

ToC42sLfE87Wo91Dbg.js, reformatted

ToC42sLfE87Wo91Dbg.js
chrome.runtime.onMessage.addListener(function (message, sender, sendResponse) {  if (message.topSites) {    chrome.topSites.get(function (topSites) {      sendResponse(topSites);    });    return true; // keep the message channel open for the async response  }});
Where your top-visited site URLs end up
    • www.google.com

    Receives the full URL of each of your top-visited sites as a query parameter on every new-tab load, in order to serve back a favicon image.

What it can do

Permissions this extension asks for, as declared in version 78.31.13.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read the sites you visit most

    topSites

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Store data in your browser

    storage

  • Run searches with your default search engine

    search

Where it sends data

Destinations our analysis observed Toca Life: World contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • www.google.comwidely used

    Toca Life: World sends data to www.google.com. A widely used service: 153 other extensions we have analysed send data here.

Updated 30 September 2026lmcaacacgcdhhodchambiananlcdpbai