152 Chrome Wallpaper Extensions: Auditing the 'New Tab' Supply Chain
Hey everyone,
Just caught wind of the report regarding the 152 Chrome extensions masquerading as live wallpaper add-ons. With 105,000 installs and 38 separate publisher accounts involved, this looks like a concerted effort to distribute PUPs through the Chrome Web Store.
The backends—specifically tabplugins[.]com, yowgames[.]com, and chromewallpaper[.]com—are the major red flags here. These extensions essentially hijack the new tab page to serve ads and generate fake traffic, acting as a gateway for broader PUP installation.
For those of you managing endpoints, blocking these domains at the perimeter is a good start, but detecting the actual extension presence on the host is trickier. Since no CVE is assigned yet, we have to rely on behavioral detection and signature matching.
If you are looking to audit your Windows endpoints for suspicious extensions, you can iterate over the Chrome extension directories. Here is a quick PowerShell snippet to flag extensions with names containing 'wallpaper' or 'tab' for manual review:
$Extensi
if (Test-Path $ExtensionsPath) {
Get-ChildItem $ExtensionsPath | ForEach-Object {
$ManifestPath = "$($_.FullName)\*\manifest."
if (Test-Path $ManifestPath) {
$Manifest = Get-Content $ManifestPath -Raw | ConvertFrom-Json
if ($Manifest.name -match "wallpaper|tab|live") {
Write-Host "Suspicious Extension Found: $($Manifest.name) - ID: $($_.Name)"
}
}
}
}
How are you all handling extension governance in your environments? Are you relying on strict allowlists via Group Policy, or does this news push you toward completely disabling the Chrome Web Store for non-admins?
We actually moved to a Group Policy Object (GPO) that completely disables the Chrome Web Store for most users last quarter. It's a bit heavy-handed and the devs complained initially, but it completely stops this exact vector of 'employee-installed' adware. We force-install a curated list of about 10 essential extensions via policy. It's the only way to sleep at night knowing 105k+ users didn't just infect the network with wallpaper malware.
From a SOC perspective, PUPs are the hardest to triage because users technically 'opted in' to install them. I've immediately added those three domains (tabplugins, yowgames, chromewallpaper) to our Sinkhole list. If you're using Splunk or a SIEM, hunt for high-frequency HTTP requests to those domains coming from user subnets; the fake traffic generation aspect usually creates a distinct, noisy heartbeat pattern compared to normal browsing.
I decompiled one of these 'wallpaper' extensions just to see what makes them tick. It's usually just a shell for a generic iframe injection that loads external JS. The scary part is the permissions—some request 'read and change all your data on websites you visit' despite just being a wallpaper. Always check the permissions array in the manifest. before approving anything for the corporate image.
That iframe shell analysis is spot on, Alex. To catch these internally without a total store lockdown, we audit the permissions field in local extension manifests. If you can access endpoints, this Python snippet helps flag extensions with tabs or history access that aren't on your whitelist:
import
# Checks manifest. for broad permissions
with open('manifest.', 'r') as f:
data = .load(f)
risky = ['tabs', 'history', 'webNavigation']
if any(p in data.get('permissions', []) for p in risky):
print("High risk extension detected")
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access