McLaren 570S Live Wallpaper New Tab

AI Security Review

Evidence context: threat category browser hijack; evidence quality moderate.

This extension, named "McLaren 570S Live Wallpaper New Tab," presents significant browser hijacking concerns based on its network behavior. The extension's description claims to transform the new tab into a McLaren 570S live wallpaper, yet the evidence reveals connections to 237 suspicious domains including j.vg, ԋr.at, gn.ai, e.cv, 4p.tg, ѧ-s.cf, om.ye, dlf.pn, 8.so, n.ni, and 4.cu. These domains exhibit classic adware/hijacker characteristics: short names, unusual TLDs (.vg, .tg, .cf, .ye, .pn, .cu), and some contain non-Latin characters (ԋr.at uses Armenian script, ѧ-s.cf uses Cyrillic characters). None of these domains are CDN infrastructure, analytics services, or related to McLaren or legitimate wallpaper services.

The network finding NET-FETCH-js/popup.js-35 confirms active fetch calls in js/popup.js:35, indicating the extension actively communicates with these domains. This behavior combined with new tab page replacement functionality is the textbook pattern for browser hijacking extensions that monetize through ad networks rather than delivering legitimate content.

The developer identity "[email protected]" is an email address rather than a verified company name, providing no accountability. With only 276 users, this is a small extension without the scrutiny of major publishers.

The strongest counterargument would be that the extension is simply a legitimate wallpaper tool using ad networks for monetization. However, this fails because: (1) legitimate wallpaper extensions do not require 237+ external domains, (2) the domain patterns (Cyrillic/Armenian characters, obscure TLDs) are inconsistent with legitimate ad networks, and (3) the extension replaces the new tab page, giving it control over user browsing behavior beyond its stated purpose. The absence of malware signatures and obfuscation findings does not negate the hijacking behavior, which is the primary threat here.

This extension should be flagged as browser hijacking risk due to its new tab replacement combined with connections to suspicious, non-legitimate domains.

Key Reasons

• 237 IoC findings pointing to suspicious short domains with unusual TLDs
• New tab page replacement functionality combined with external domain connections
• Domains contain non-Latin characters (Cyrillic/Armenian) suggesting obfuscation
• Developer uses generic email address rather than verified company name
• Network fetch calls in js/popup.js:35 confirm active communication with suspicious domains

False Positive Considerations

• 22 code-smell findings are low-severity noise per CVEQ guidelines
• No malware signatures or obfuscation findings to suggest FP from bundled code

Reviewed 2026-05-09; recommended action: escalate; model confidence 78%.