Vestrahorn Mountain Iceland Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality moderate.

Vestrahorn Mountain Iceland Live Wallpaper replaces the new tab page with video wallpaper of an Icelandic mountain. It is published under the contact address [email protected], sits at version 1.1.2, and has 48 users. Six findings came back, all of them in the network category at medium severity, and every one marks a fetch() call: NET-FETCH-js/background.js-63, NET-FETCH-js/background.js-82, NET-FETCH-js/background.js-96, NET-FETCH-js/popup.js-39, NET-FETCH-js/sidePanel.js-362 and NET-FETCH-js/weather.js-49. There are no malware signatures, no obfuscation hits, no injected domain list, no secret exposure and no manifest tampering in the results.

Read those six lines together and you get the shape of a new tab page that talks to a server. The background worker makes three requests, which is ordinary for a page that refreshes content or checks a state. The popup makes one, the side panel makes one, and js/weather.js:49 makes one, which points at a weather widget on the new tab screen. That last file is the piece someone installing a wallpaper might not expect, though weather on a new tab page is one of the most common features in this category.

The request destinations are the question the evidence leaves open. No domain was captured for any of the six calls, so the findings describe a capability. Nothing shows an observed transfer. The extension declares no permissions and no host permissions, which matters: without host access the browser blocks a cross-origin fetch unless the receiving server allows it through CORS. Whatever these calls reach, they do not run with the ability to read the pages you visit, touch cookies, or modify other sites.

A skeptic would push back here, and reasonably. A wallpaper extension shipping a side panel and a weather module is broader than its store listing implies, and an anonymous publisher whose only attribution is a contact email gives no company to hold accountable. If this were a hostile extension, fetch calls in a background worker are exactly where you would look for beaconing, and the absence of recorded endpoints could mean the extractor never resolved them. That reading deserves a test, and a runtime capture of the URLs requested from background.js:82 would settle it in minutes.

The verdict rests on what the scanner actually matched. Six fetch() calls in ordinary application scripts, with no encoding layer, no suspicious domain, no credential access and no permission to act on other pages, is what a working new tab page looks like from the inside. Capability on its own does not make an extension dangerous, and nothing here moves past capability into behavior.

Key Reasons

• All six findings are fetch() call sites in js/background.js, js/popup.js, js/sidePanel.js and js/weather.js; no destination domain was captured for any of them
• No malware signatures, obfuscation, IoC entries, secret exposure or manifest-analysis findings accompany the network hits
• The extension declares no permissions and no host permissions, limiting what any of these requests could read or change
• js/weather.js:49 fits a common new tab weather widget rather than an unexplained beacon
• No impersonation signal: the name and description describe an Icelandic mountain wallpaper, with no borrowed branding from a popular extension

False Positive Considerations

• fetch() usage flagged as medium-severity network findings with no resolved endpoint
• New tab extensions in this category routinely call a weather API
• Zero IoC, obfuscation or malware-signature matches in a 6-finding result set

Reviewed 2026-10-18; recommended action: suppress false positive; model confidence 76%.