Ultraman Tiga Live Wallpaper

AI Security Review

Evidence context: threat category adware; evidence quality moderate.

The extension’s manifest advertises a new‑tab wallpaper feature, but the code contains hard‑coded references to a set of short, unrecognised domains. Each entry—such as XIOC-DOMAIN-g.ms, XIOC-DOMAIN-x.ua, XIOC-DOMAIN-m.co, XIOC-DOMAIN-6.tr, XIOC-DOMAIN-e.pa, XIOC-DOMUAGE-e.gt, XIOC-DOMAIN-h.gf, XIOC-DOMAIN-ś.gi, XIOC-DOMAIN-q.hm, XIOC-DOMAIN-b.yt, XIOC-DOMAIN-r.eg, and XIOC-DOMAIN-y.wf—is reported from the generic source "extracted_from_files". These domains are not part of any known CDN, analytics platform, or the extension’s own infrastructure, and they are typical of URL shorteners or ad‑network endpoints that have been used in previous malicious extensions.

No malware‑signature or obfuscation findings are present, and there are no code‑smell alerts, indicating that the JavaScript itself is not deliberately hidden or maliciously crafted. However, the sheer presence of twelve distinct, low‑reputation domains suggests the extension will fetch remote resources—likely image files or scripts—to display in the new‑tab page. This behaviour aligns with common adware patterns where a seemingly innocent visual enhancement is coupled with background calls to advertising or tracking services.

The developer information consists solely of an email address ([email protected]) without an affiliated organization or verified publisher profile. The extension’s description mentions only the visual feature and provides no privacy or data‑usage disclosure. The lack of a reputable developer and the anonymous publishing model increase the risk that the remote calls are not transparently documented.

From a user‑impact perspective, the extension hijacks the browser’s default new‑tab page, replacing it with live wallpapers. While this is a benign‑looking feature, the underlying network calls to the listed domains could expose users to unwanted ads, tracking scripts, or further payload downloads. Because no explicit malicious payload is detected, the risk is classified as adware/potentially unwanted rather than outright malware.

Counterargument: A skeptic might argue that the domains could belong to legitimate image‑hosting services used by the wallpaper provider, and that the IoC extractor is over‑reporting harmless URLs. While this is possible, the domains are unusually short and do not correspond to known image‑hosting providers (e.g., imgur.com, unsplash.com). Moreover, the extension provides no transparency about why these particular domains are needed, nor does it implement any user‑opt‑out mechanism. Given the pattern of similar extensions that have abused obscure domains for ad injection, the conservative interpretation is that these endpoints are likely ad‑related.

In summary, the extension’s new‑tab hijacking combined with undisclosed contacts to multiple obscure domains represents a clear adware risk, even though no explicit malicious code is present.

Key Reasons

• Hard‑coded references to multiple obscure domains (e.g., g.ms, x.ua) in code
• Extension hijacks the new‑tab page to display live wallpapers
• Anonymous developer publishing with only an email address
• No malware signatures or obfuscation detected, indicating simple adware behavior
• Lack of privacy disclosure for the network calls

False Positive Considerations

• IoC extractor generic domain detection
• High count of short, unknown domains
• No malware signatures or obfuscation
• Bundled dependencies not present

Reviewed 2026-06-01; recommended action: monitor; model confidence 78%.