Cyberpunk 2077 Phantom Liberty Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

A Chrome extension that displays HD live wallpapers themed on Cyberpunk 2077: Phantom Liberty, published under the contact address [email protected], at version 1.2 with roughly 183 users. The manifest declares no permissions and no host permissions. That constrains what the code is able to do. A Manifest V3 background service worker without host permissions cannot quietly reach arbitrary third-party servers and post data back; cross-origin requests from the service worker are limited to endpoints that send permissive CORS headers.

Six medium-severity findings turned up, all of them network fetches: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362, and NET-FETCH-js/weather.js-49. Each one records that a fetch call sits at that line. None of them records the destination. The scan pulled zero indicators of compromise, zero malware signatures, zero obfuscation markers, zero credential or cookie access, and zero code-smell matches. Six fetch calls spread across four scripts is a small footprint, and nothing ties those calls to a suspicious host.

The file layout is mildly unusual. js/weather.js and js/sidePanel.js sit alongside a wallpaper extension, which means the package bundles a weather widget and a side panel view on top of the wallpaper feature. Extras like these are common in new tab and wallpaper extensions, and they account for three of the six fetch calls. What would settle the question is the literal URL string at js/weather.js:49 and at js/background.js:63. A weather endpoint and a wallpaper image host would close the matter. A domain with no relation to either feature would change the picture.

A skeptic could reasonably point at the name: a live wallpaper extension built on a commercially licensed game, published under a bare email address instead of a company name, shipping a weather module that has nothing to do with wallpapers. That combination deserves a second look in general. Here the specific evidence that would make it harmful is absent. No host permissions were requested, so the extension has no standing access to browsing data. No cookies, webRequest, history or tabs access appears anywhere in the manifest. No suspicious domain was extracted from any file.

The six flags come from a scanner rule that marks every fetch() call at medium severity without regard to destination. With no endpoints, no IoCs and no malware signatures to weigh against it, the fetch flags describe ordinary network use in a wallpaper and widget extension.

Key Reasons

• All six findings are NET-FETCH detections on ordinary fetch() calls with no destination, payload or exfiltration detail attached
• The manifest declares no permissions and no host permissions, so the service worker cannot silently reach arbitrary hosts or read browsing data
• No IoCs, no malware signatures, no obfuscation and no credential or cookie access were found anywhere in the package
• Bundled widgets in js/weather.js and js/sidePanel.js explain the off-theme scripts without implying hidden behavior
• Publisher is attributable to a domain (gameograf.com) rather than an anonymous listing

False Positive Considerations

• Generic NET-FETCH rule fires on every fetch() call at medium severity regardless of destination
• No endpoints or host permissions extracted, so the flags carry no information about where traffic goes
• Small, non-bundled JavaScript (four scripts) means the six findings are the entire scan surface
• Wallpaper and new tab extensions routinely include off-theme widgets such as weather and side panels

Reviewed 2026-10-11; recommended action: suppress false positive; model confidence 78%.