What our analysis found

Car vehicle auto live wallpaper, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 3 findings (1 high, 1 medium, 1 low), led by remote code loading. It comes from a trusted publisher and was last updated in September 2025.

Key findings

• High

  Remote Code Loading

  The extension fetches an `html` field from the publisher's API and injects it directly into the DOM via `innerHTML` with no sanitization. While scripts in `<script>` tags injected through `innerHTML` do not execute, elements with inline event-handlers (e.g. `<img src=x onerror=...>`, `<svg onload=...>`) do execute, giving the remote server a persistent code-execution channel that entirely bypasses Chrome Web Store review. A compromised or intentionally malicious server response could achieve arbitrary JavaScript execution in the new-tab page context.

  Show more — Remote Code Loading
• Medium

  Code Injection

  Shortcut data fetched from `[domain withheld] — including `link.url`, `link.name`, and `link.icon` — is interpolated directly into an HTML template string and parsed by jQuery without escaping. A publisher-controlled API response containing `"><script>` or event-handler payloads in any of these fields would achieve DOM injection in the new-tab context. Combined with the remote-HTML sink, this establishes two separate server-controlled injection surfaces.

  Show more — Code Injection
• Low

  Other

  The service worker unconditionally enumerates and deletes every IndexedDB database on every startup, not just on install. In the service-worker context this is scoped to the extension's own origin, so it does not affect other sites; however, this permanently destroys any locally cached extension state (e.g. previously saved user preferences or offline data) on each browser restart, which is an unexpected and destructive behaviour inconsistent with the extension's stated purpose as a replacement.

  Show more — Other