Kratos Dragon Slayer God of War Live Wallpaper

AI Security Review

Evidence context: threat category none; evidence quality weak.

This is a Chrome new tab replacement that swaps the default page for live wallpapers, published under the email [email protected] at version 1.0.3. The manifest declares no permissions and no host permissions. A new tab override does not require a permission entry, so an empty list here means the extension cannot read cookies, cannot open files on disk, and cannot call remote hosts from a background script.

The scan returned 187 findings: 168 domain matches from the XIOC extractor and 19 low-severity code-smell rules. Zero malware signatures were recorded. Zero obfuscation. Zero network findings. Zero secrets. That distribution is the whole story, because the volume sits entirely in the two categories that are known to produce noise.

Look at what the domains are. 'XIOC-DOMAIN-n.nu', 'XIOC-DOMAIN-e.im', 'XIOC-DOMAIN-u.ky', 'XIOC-DOMAIN-v.az', 'XIOC-DOMAIN-w.kz' and 'XIOC-DOMAIN-ɜ.sl' each consist of a single character in front of a two-letter country code. The endpoint list repeats the same shape with a5.gb, ah.cg, ai.ad, bg.mp, bn.vc, d6.sa and eq.nc. Real hostnames do not look like this. This is a pattern matcher running over bundled JavaScript and reading short property lookups, the h.next and g.id kind, as hostnames. Two entries settle it: '5ⱦ.vu' and 'ǣ.ru' contain characters that cannot appear in a DNS name at all.

One entry is a genuine string. 'XIOC-URL-https://haberikra.com/?p=14695?utm_source=haberikra&utm_medium=haberikra');' carries the file path 'extracted_from_files'. The stray '); on the end is the tell. That is a link to a Turkish news post lifted from source text or page markup, and the manifest gives the extension no reach to fetch it.

The remaining 19 matches are code-smell rules at severity low, fired alongside no malware signature and no obfuscation. That combination is what a bundled image loader or slider library produces on contact with a scanner. A wallpaper pack shipping a third-party carousel will trip those checks every time, and none of them describe behavior this extension can perform without permissions.

The strongest counterargument is the publisher profile. An anonymous Gmail address, a listing at zero users, and a God of War name look like a throwaway upload, and 168 flagged domains sounds heavy until you read them. They are not plausible destinations, and the extension asks for no capability to reach any destination. The one thing the listing does get wrong sits outside security: Kratos and God of War are Santa Monica Studio properties, and the name and art are used with no attribution to the rights holder. That is a store licensing question, not evidence of malicious code.

Key Reasons

• No malware signatures, no obfuscation, no network findings and no secrets; all 187 matches fall into the 168 XIOC domain and 19 low-severity code-smell buckets
• The flagged endpoints are one-character labels on ccTLDs (a5.gb, e.im, u.ky, ah.cg, eq.nc), the documented signature of XIOC misreading property lookups in bundled JavaScript
• Two extracted entries, '5ⱦ.vu' and 'ǣ.ru', contain characters that are invalid in DNS, confirming extractor artefacts
• The manifest declares no permissions and no host permissions, so the extension has no path to cookies, local files, or remote hosts
• The only real URL, haberikra.com, was captured with a trailing '); under file_path 'extracted_from_files', indicating a scraped string rather than a runtime request

False Positive Considerations

• XIOC domain extraction over bundled or minified JavaScript producing single-letter ccTLD fragments
• Code-smell rules at severity low, which fire on any non-trivial JavaScript library
• Finding volume inflated by an image or slider dependency shipping alongside the wallpaper logic
• Zero malware, obfuscation, network, secret or manifest-analysis findings despite 187 total matches

Reviewed 2026-09-30; recommended action: suppress false positive; model confidence 75%.