Is Winter Snow Wallpaper safe?
Winter Snow Wallpaper sends most-visited site URLs to Google's favicon service on the new-tab page.
When you open a new tab, the extension reads Chrome's topSites list to show shortcuts for frequently visited pages. It loads each shortcut icon from Google's favicon service using the full topSites URL as a query value, sending those most-visited URLs to Google.
Who publishes itfiona.leong - 2 other listings from the same operator, 1 of them carrying a finding
fiona.leong - 2 other listings from the same operator, 1 of them carrying a finding
What this publisher told the store about itself, and the other listings that told it the same thing.
Same store account
2 other listings published from this account, 12k+ users between them. 1 of them carries a finding.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New-tab menu sends your most-visited site URLs to Google favicon service
Every time you open a new tab, the extension reads your Chrome most-visited list and requests site icons from google.com, placing each visited URL in the request itself.
We captured 7 such requests carrying real browsing history.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open a new browser tab.
The extension has overridden Chrome's new-tab page.
The page requests your Chrome most-visited list and sends each site's full URL to Google as part of a favicon lookup.
This happens automatically, with no prompt, on every new tab.
Returns a favicon image; the visited-site URL was already disclosed in the request itself.
- Full URL of a site you recently visitedhttp://chatgpt.com/
Sent in cleartext as the domain= query parameter on every icon request.
- Your most-visited sites, as a setchatgpt.com, facebook.com, youtube.com, x.com
Up to 10 entries from Chrome's topSites list are disclosed per new tab.
The favicon URL is built directly from your browsing history
Readable equivalent
function renderMostVisited() { chrome.runtime.sendMessage({ topSites: true }, function(topSites) { let count = 0; for (let i = 0; i < topSites.length && count < 10; i++, count++) { const site = topSites[i]; const faviconUrl = 'https://www.google.com/s2/favicons?domain=' + encodeURIComponent(site.url); appendMenuItem(site.url, site.title, faviconUrl); } });}renderMostVisited();- www.google.com
Receives each most-visited URL as a query parameter on a favicon-image request. This endpoint is Google's public favicon service, not an endpoint the extension's vendor controls.
What it can do
Permissions this extension asks for, as declared in version 18.31.1.45. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read the sites you visit most
topSites
Store an unlimited amount of data in your browser
unlimitedStorage
Store data in your browser
storage
Run searches with your default search engine
search
Where it sends data
Destinations our analysis observed Winter Snow Wallpaper contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- www.google.com/s2/faviconswidely used
Winter Snow Wallpaper sends data to www.google.com/s2/favicons. A widely used service: 132 other extensions we have analysed send data here.