Favicon Changer Ultimate

Elliot Lawrence2026年7月9日

★★★★★5

Works good, simple but intuitive UI.

Alexandr Antipin2026年7月3日

★★★★★5

I've tried a few similar extensions today, this one it the first that did the job for me. Nice UI. Asked claude to analyze it, looks safe: Analysis complete. Here's the verdict on Favicon Changer Ultimate (v1.3.0, ID egedbdckafdbomehjaihjhbcgmngmlah), located at ~/Library/Application Support/Google/Chrome/Default/Extensions/egedbdckafdbomehjaihjhbcgmngmlah/1.3.0_0/: Overall: appears legitimate and benign. No malware indicators found. Key findings: - Permissions are minimal and match the stated purpose: storage, scripting, plus host_permissions: <all_urls>. The broad host access is required because it needs to run on every site to apply favicon rules — not itself suspicious, but it is the one permission worth being aware gives it capability to inject scripts anywhere. - No exfiltration channel: no XMLHttpRequest/fetch to any third-party endpoint except (a) fetching the current page's own favicon or a user-uploaded image to convert it locally to a blob, and (b) https://www.google.com/s2/favicons?domain=... — Google's public favicon-preview API, called only when you manually type a domain into the "default favicon" picker. This leaks that single domain string to Google, nothing else (no cookies, history, or page content). - No remote code execution: CSP is locked to script-src 'self'; no eval/Function() on remote content. The atob(...) use is just decoding local data: URIs for image validation. - No sensitive APIs used: no chrome.cookies, chrome.history, chrome.webRequest, chrome.identity, no credential access. - Debug logs are local-only: an opt-in verbose logger writes to chrome.storage.local and is only exposed via manual "Copy"/"Download" buttons for user-initiated support — never auto-transmitted. - Installed from the Chrome Web Store, not sideloaded — confirmed by update_url: clients2.google.com/service/update2/crx and a valid _metadata/verified_contents.json signature. - The <all_urls> content script does run on every page at document_start and uses a MutationObserver + polling to keep re-applying your chosen favicon — this is more "aggressive" than a typical favicon extension needs, but it's aimed at the <link rel="icon"> tag only, not at page content, forms, or credentials. Nothing here matches known malware patterns (no injected ads, no affiliate-link rewriting, no clipboard hijacking, no arbitrary remote script loading, no data collection beyond the one Google favicon lookup). It's a reasonably well-built, if permission-broad, single-purpose extension.

Palaniappan M2026年3月10日

★★★★★5

Works as intended. I particularly like the ability to overlay a badge over existing favicon.

Ross Vassilev2026年3月8日

★★★★★1

useless.