Chrome Web StoreCaution required
Suspicious in code review (v3.1.0)
Our reviewer found behaviour consistent with malware in version 3.1.0, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Gojo vs Sukuna Jujutsu Kaisen Live Wallpaper, used by 2,000 people, is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by remote code loading. It comes from a trusted publisher and was last updated in November 2025.
Key findings
- Medium
Remote Code Loading
An arbitrary HTML blob fetched from the publisher's server is assigned directly to innerHTML of a fixed-position, z-index 99999 overlay (:419-432) rendered on every new tab. This is not remote code execution — innerHTML does not execute <script> and the MV3 extension_pages CSP blocks inline handlers — but it is a remote-hosted-content channel that lets the publisher place unreviewed UI (deceptive overlays, off-site forms, iframes, arbitrary links) in front of all 2,000 users at any time with no version update and no Chrome Web Store review. The timestamp gate confirms it is designed as a recurring push channel, not a one-off, and it is the only mechanism in this otherwise minimal-permission wallpaper extension whose behaviour cannot be determined from the shipped code.
Analyst notes
This is a genuine Jujutsu Kaisen new-tab wallpaper extension (video background at:3, clock, sticky notes, chrome.search.query at:169) with exactly one permission, `search`, and a bundled manifest that matches the published CWS manifest byte-for-byte; both outbound calls are bodiless GETs to the publisher's own [domain withheld], and no browsing history, cookies, page content, keystrokes or identifiers are collected or sent anywhere, so the ML 0.87 is not supported by any data-flow evidence. What keeps it off `likely_benign` is:41-54: the extension fetches ` ` and assigns the server-supplied `html` field straight into `#remote-popup.innerHTML`, a fixed-position z-index 99999 overlay (:419-432), giving the publisher a channel to push arbitrary unreviewed UI onto every new tab without a store update — the standard delayed-malicious lever, even though innerHTML will not run `<script>` and the MV3 extension_pages CSP blocks inline handlers. Corroborating signals are weaker than they appear: the permhash 33% figure, the publisher-malicious count, the publisher-flagged bit and the internal note all trace to the same malext feed import, which states it is "not an independent code review"; chrome-stats ( impact, trusted-publisher) and our own risk engine (0.10 Low) contradict the ML score, and the ML's own counters are trivial on inspection. Non-findings worth recording::19-25 wipes all IndexedDB databases, but a service worker only sees the extension's own origin; the server-fed shortcut list at:21-40 with unescaped `${link.url}`/`${link.name}` interpolation at:96-105 is the advertised "Popular Shortcuts" feature and only touches the extension's own page, so it is hygiene, not a finding; and the listing name says Jujutsu Kaisen while the description describes Ball and advertises a "News Feed Bar" that does not exist in the code, which is template reuse across this publisher's ~1,388 near-identical wallpaper extensions, not malice. is listed in the signed _metadata inventory but absent from the analysis bundle, so it was not reviewed; the inventory lists no other JS file, which rules out the ` ` implied by the stale comment at:92.
Gojo vs Sukuna Jujutsu Kaisen Live Wallpaper Chrome extension security report
ID: bnfaaghomnaapfpnneicbofihhghllfa
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://gameograf.com/
- Privacy
- Privacy Policy
- Help
- Help Center
- Country
- US
- Address
- Thunder Rd NW Concord, NC 28027 US
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Witness the epic clash of Gojo vs Sukuna with this intense live wallpaper for your Chrome browser! ⚔️👹✨
Read the publisher’s full description
Embrace the raw power of Goku in his Ultra Instinct form with this epic live wallpaper. Featuring Goku radiating energy against a cosmic backdrop, this extension brings the fierce battles and awe-inspiring moments of Dragon Ball Super right to your new tab. Perfect for Dragon Ball fans, this live wallpaper immerses you in the legendary series every time you open a new tab, showcasing Goku’s ultimate transformation. Key Features 🖼️ Dynamic HD Live Wallpaper Video 📰 News Feed Bar – Stay updated with trending anime, gaming, K-pop, and entertainment news. 🔗 Popular Shortcuts – Quick access to YouTube, Netflix, ChatGPT, Amazon, and more. ➕ Custom Shortcuts – Add your favorite websites for instant access. 🔍 Search Bar – Works seamlessly with your default search engine. 🕒 Clock & Date – Minimalist, always-on time & date widget. 📝 Sticky Notes – Colorful, draggable notes on your new tab. 🔔 Notifications – Get alerts about new wallpapers & features. 📧 Google Apps – One-click access to Gmail, Maps, Drive, and more. 🤖 ChatGPT Widget – Ask questions and get instant AI-powered answers. ✅ To-Do List – Organize your daily tasks directly on your new tab. 📅 Calendar Tool – Keep track of important dates. 🧮 Calculator – Perform calculations without leaving Chrome. ⏳ Timer – Built-in countdown for productivity or breaks. 🛠 More Tools – Includes privacy settings, uninstall guide, and support. About Us Gameograf.com creates exclusive Chrome new tab extensions to make browsing more personalized and fun. Explore our vast library of anime & manga, K-pop, cars & bikes, sports, celebrities, and more unique themes designed for fans worldwide. 🌐 Website: https://gameograf.com 📩 Contact: https://gameograf.com/contact-us/ 🔒 Privacy Policy: https://gameograf.com/privacy-policy/ 💬 Feedback: https://gameograf.com/feedback/ 📧 Email: support@gameograf.com Affiliate Policy Notice When installed, this extension opens a new tab at https://gameograf.com, where you can explore similar themes. Some links may include affiliate partnerships, meaning Gameograf.com may earn a small commission if you purchase through them. These commissions help us maintain and improve our free extensions.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
44 indicators in this extension
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from https://gameograf.com/
- Anime Cursor - Custom Cursor for Chrome™ - All in One Anime Cursors40,000 users
- Cristiano Ronaldo Live Wallpaper20,000 users
- Sukuna X Gojo Jujutsu Kaisen Gameograf20,000 users
- Gameograf ONE New Tab: Live Wallpapers20,000 users
- Nissan Skyline Live Wallpaper New Tab10,000 users
Popular in Art & Design
- Image Downloader2,000,000 users
- Image downloader - Imageye2,000,000 users
- Adobe Photoshop800,000 users
- Sumopaint - Online Image Editor600,000 users
- Save Image As PNG500,000 users