Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
Howl’s Moving Castle Wallpaper is rated caution by Extension Auditor. Our code review reported 1 finding (1 medium), led by other. It comes from a trusted publisher and was last updated in May 2025.
Key findings
- Medium
Other
Arbitrary server-controlled HTML is rendered into the new tab page on every new tab, with no sanitization and no schema beyond {html, timestamp}. MV3's default CSP (script-src 'self') blocks scripts in that HTML, so this is not remote code execution, but the publisher can push arbitrary links, images, forms or iframes into a page the user opens dozens of times a day, changeable at will without any Chrome Web Store review. The same pattern appears at:236-248, where remote supplies values interpolated unescaped into the shortcut template, giving the server control over where every shortcut click goes. No abuse was observed in the currently served content; this is a capability finding.
Analyst notes
The extension does what its listing says (5 bundled Ghibli wallpapers in, a clock, shortcuts, and a search box that calls chrome.search.query so the user's default engine is used, with no chrome_settings_overrides and therefore no search hijack, the usual monetization in this permhash cluster), and the bundled manifest matches the published one exactly. What keeps it out of 'benign' is a genuine remote-control surface::41-66 fetches JSON from [domain withheld] and assigns the server-supplied `html` field straight to innerHTML of the new tab page on every new tab, and:236-248 builds shortcut anchors from unescaped server-supplied values, so the publisher can change the content and click destinations of every user's new tab at any time without a Chrome Web Store review. Contradicting the ML score: no user data leaves the browser (both requests are static JSON GETs to the publisher's own declared host), only opens [domain withheld] on and wipes only the extension's own IndexedDB origin, the [domain withheld] video fetch is dead code (openIndexedDBAndFetchVideos is never called and are undefined), chrome-stats scores it with a trusted-publisher badge, and the 'malware' internal note is a self-described unverified feed import, not a code review.
Howl’s Moving Castle Wallpaper Chrome extension security report
ID: cbnbfcpfpapmidckihagpdibdbaikppg
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- https://gameograf.com/
- Privacy
- Privacy Policy
- Country
- US
- Address
- King phillip Rd Mattapoisett, MA 02739 US
- Website
- Visit
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Screenshots & videos
Install growth
- 1 medium
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Add a touch of magic with Howl’s Moving Castle Wallpaper – stunning Studio Ghibli visuals for every new tab.
Read the publisher’s full description
Enchanting, Dreamy, Artistic, Ghibli-Inspired Extension Features Rotating HD Wallpapers: Enjoy five beautifully selected high-resolution wallpapers from Howl’s Moving Castle, changing with every new tab. Popular Site Shortcuts: One-click access to YouTube, Amazon, ChatGPT, Netflix, and more. Custom Website Shortcut: Add your favorite site for personalized convenience. Search Bar: Built-in search bar uses your default search engine for easy browsing. Clock & Date Display: Sleek display of the current time and date. Additional Options: Quick links to extra extensions, privacy info, uninstall, and feedback page. About Howl’s Moving Castle Howl’s Moving Castle is a fantasy masterpiece from Studio Ghibli, directed by Hayao Miyazaki. Based on the novel by Diana Wynne Jones, it tells the story of Sophie, a young woman cursed with an old body by a wicked witch, and her encounter with the mysterious wizard Howl and his magical moving castle. The film explores themes of identity, love, and anti-war sentiment, all wrapped in breathtaking animation and whimsical storytelling. With its blend of steampunk landscapes and heartwarming characters, this wallpaper extension captures the visual beauty and emotional magic of Ghibli’s world. About Us Gameograf.com creates exclusive new tab extensions and themes for Chrome. Our website offers a variety of new tab extensions featuring anime-manga, singers, cars-motorcycles, sports teams, athletes, celebrities, and K-pop. Website: https://gameograf.com Contact Us: https://gameograf.com/contact-us/ Privacy Policy: https://gameograf.com/privacy-policy/ Feedback: https://gameograf.com/feedback/ Email: info@gameograf.com Google Chrome Affiliate Program Disclosure This extension, when installed, opens the gameograf.com website in your new tab to provide information about the downloaded extension. It is designed to enhance user experience, offer access to similar extensions, and help users create their own. The extension may contain links to specific services or products per policy. All redirects are designed for user benefit and require consent before any action is taken.
User reviews
Extension files
Browse and explore files within this extension package
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 medium-severity finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Code Diff
Compare extension code between any two versions.
0 changed files detected
No comparable text files found between these versions.
You reached today's free scan limit (3/3 unique extensions).
Upgrade for full visibility.
Related extensions
More from https://gameograf.com/
- Anime Cursor - Custom Cursor for Chrome™ - All in One Anime Cursors40,000 users
- Sukuna X Gojo Jujutsu Kaisen Gameograf20,000 users
- Gameograf ONE New Tab: Live Wallpapers20,000 users
- Cristiano Ronaldo Live Wallpaper20,000 users
- Nissan Skyline Live Wallpaper New Tab10,000 users
Popular in Just for Fun
- Custom Cursor for Chrome™6,000,000 users
- Return YouTube Dislike5,000,000 users
- Stylish - Custom themes for any website2,000,000 users
- FrankerFaceZ1,000,000 users
- Shimeji Browser Extension1,000,000 users