Yoichi Isagi in Blue Lock Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Yoichi Isagi in Blue Lock Live Wallpaper is a new tab replacement that shows HD anime wallpapers, and the manifest it ships lists an empty permissions array and an empty host_permissions array. Nothing in it grants access to cookies, tabs, history, or the contents of pages you visit. That absence shapes everything below, because an extension cannot quietly ship browsing data to a server without a permission that reaches that server.

The entire finding set is six medium-severity network observations: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. Each marks a fetch() call site. A wallpaper extension needs exactly this. background.js pulls the wallpaper catalog so a new tab paints without a delay, sidePanel.js:362 and popup.js:39 load settings and preview lists, and weather.js:49 is the weather widget asking for a forecast. None of the six came with an extracted URL, and no destination host is listed anywhere in this scan, so no third-party endpoint is named in the data.

What is missing matters more than what is present. There are no malware signatures, no obfuscation matches, no imported indicator lists, no embedded secrets, no code-smell rules and no dependency findings. Version 21.2.3 with a plain contact address ([email protected]) in the developer field fits the long tail of wallpaper extensions that bump version numbers often to push new art packs. The description names an anime and a character. It does not borrow the name of a popular security or utility extension, so there is no typosquat target here.

A skeptic would make one fair point: six fetch calls with no recorded destinations leave the endpoints unknown, and a wallpaper extension that also ships js/weather.js has to reach some weather service, probably with an API key compiled into the bundle. That is worth checking, though the concern it raises is about privacy. Settling it takes a look at the string literals near js/weather.js:49, which this scan did not capture. Nothing in the current data points to a remote code loader, a search hijacker or a cookie reader, and a hijacker needs chrome_url_overrides paired with a search provider override to function, neither of which sits alongside these fetch sites.

Users get a themed new tab with rotating art. The scanner flagged the network layer of an extension whose whole job is network work.

Key Reasons

• All six findings are fetch() call sites inside the extension's own scripts (NET-FETCH-js/background.js-63, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362, NET-FETCH-js/weather.js-49), which wallpaper loading and a weather widget require
• The manifest declares empty permissions and host_permissions arrays, leaving no path to cookies, tabs or browsing history
• Zero malware signatures, obfuscation matches, IoC imports, secrets, code-smell rules or dependency findings
• No endpoint URL was extracted from any of the fetch sites, so no suspicious domain is named in the scan
• No impersonation signal: the extension describes an anime wallpaper theme and does not echo a known security or utility brand

False Positive Considerations

• fetch() call sites scored as medium-severity network findings with no extracted destination URL
• No host permissions or permission entries exist to make a hostile endpoint reachable
• Wallpaper catalog and weather features require network calls by design
• Zero corroborating malware, obfuscation, IoC or code-smell matches to support the network flags

Reviewed 2026-10-17; recommended action: suppress false positive; model confidence 85%.