Is Adblock Ad Blocker Pro safe?
We analyzed Adblock Ad Blocker Pro version 2.0.17's actual code and gave it a 35/100 trust score. This ad blocker has broad access and sends detailed…
Bottom line
This ad blocker has broad access and sends detailed browsing records to its operator, with an additional unsafe remote-opening behavior.
What it can access
It can run on every website and alter pages, while also collecting detailed browsing addresses beyond what ad blocking requires.[Q1][Q3][Q6]
Security weaknesses
A server response can make the extension open an unrestricted web address without a clear user request.[Q16]
Signs of misuse
It automatically sends full browsing addresses and a persistent ID to its operator, with collection enabled by default behind a vague setting.[Q6][Q8][Q12][Q13]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests all-site host access, injects page access into every HTTP/HTTPS frame, and uses webRequest, scripting, storage, activeTab, and declarativeNetRequest. Those powers support ad blocking, but they also enable its separate browsing telemetry.
Declares *://*/*, webRequest, scripting, storage, activeTab, declarativeNetRequest, and all-frame content scripts. — manifest.json:permissions, host_permissions, and content_scripts
Observes tab URL updates and all top-level response headers. — js/service_worker.js:19543-19561
Which websites can it run on, and can it read or change what appears on those pages?
It injects packaged cosmetic-filter scripts and CSS to hide blocked elements and offers an element-selection assistant that creates custom rules. These visible page changes fit its advertised ad-blocking purpose.
Registers packaged CSS and JavaScript content scripts for enabled filter rules. — js/service_worker.js:2768-2811
Injects the packaged AdGuard-style assistant into the current tab after the user opens it. — js/service_worker.js:343-364
Applies locally stored cosmetic selectors to page elements. — js/content.js:1-29
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
It collects the previous and current full URL for tab navigations, plus request method, response content type/status, timestamp, foreground state, and a persistent user ID. Full URLs can reveal searches, document names, account identifiers, and URL-carried secrets.
Stores referrerUrl and targetUrl per tab and builds a telemetry record with userId and navigation metadata. — js/service_worker.js:19311-19443
Feeds tab URLs and top-level response metadata into the record builder. — js/service_worker.js:19543-19561
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It stores a persistent user ID, recent per-tab URL pairs, Safe Search state, allowlists, user rules, enabled rulesets, and UI settings. It does not request direct cookies or browser-history services, but its tab listeners reconstruct a browsing trail in real time.
Persists recent tab URLs and creates/stores a random UUID as userId. — js/service_worker.js:19311-19356 and 19561-19571
Reads and writes the safeSearch preference in extension storage. — js/popup.js:18375-18380 and 18512-18517
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence of this behavior was found in the reviewed package.
No camera, microphone, geolocation, desktopCapture, tabCapture, or notifications permission is declared. — manifest.json:permissions
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It posts encrypted browsing records to adblox.org and sends sampled error/diagnostic events to an adblox.org Sentry service. The browsing record includes full previous/current URLs, a persistent ID, timestamps, response metadata, and foreground state.
POSTs the encrypted navigation record to https://adblox.org/api_v1/safe_search1.php. — js/service_worker.js:19301-19310 and 19425-19443
Initializes Sentry at kent.adblox.org with a 10% error sample rate. — js/service_worker.js:18472-18487
Explicitly sends enabled-ruleset/userId and quota diagnostic messages to Sentry during updates. — js/service_worker.js:19593-19613
Does it download or run code, settings, or instructions supplied by a remote server?
On installation or update it asks adblox.org for instructions and opens whatever URL the JSON response supplies. Its blocking rules and scripts are otherwise packaged locally rather than downloaded as executable extension code.
Fetches the install endpoint, reads response.url, and opens it in a browser tab without restricting the destination. — js/service_worker.js:19631-19639
Core static blocking rule resources are bundled in the package. — manifest.json:declarative_net_request
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
Browsing telemetry runs automatically during normal navigation and is enabled unless the stored Safe Search value is explicitly false. The popup offers an opt-out switch, but the label does not explain that full URLs and identifiers are sent to the developer.
Runs the telemetry path on tab updates whenever safeSearch is not exactly false. — js/service_worker.js:19543-19546
The storage helper defaults safeSearch to true when no value exists. — js/popup.js:604-606
Shows only a Safe Search switch and privacy-policy link, without an in-product description of URL collection. — popup.html:Safe Search section
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares many enabled ad, privacy, malware, annoyance, and regional rulesets. — manifest.json:declarative_net_request
External disableTabFiltering requests add an allowAllRequests session rule for supplied tab IDs. — js/service_worker.js:19129-19175
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The application is split across very large compiled bundles with duplicated Sentry and filtering libraries and no source maps. The key telemetry, install, messaging, and blocking logic is still readable near the service worker's entry point.
Contains about 19,800 formatted lines and 905 KB of bundled code. — js/service_worker.js:entire file
No source-map files are included. — inventory.json:files
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Returns globalThis first, with new Function only in a caught fallback. — js/service_worker.js:webpack global helper near line 35
Contains the same compatibility fallback. — js/popup.js:webpack global helper near line 45
Uses Manifest V3 without an unsafe-eval CSP override. — manifest.json:manifest_version
Does it track the websites, pages, searches, or links you visit?
It tracks full web addresses as the user moves between pages and sends recent previous/current URL pairs to adblox.org. The collection covers ordinary browsing across tabs, not just search-engine safety checks.
Maintains referrerUrl and targetUrl for as many as 100 tab entries. — js/service_worker.js:19311-19356
Places both full URLs in the transmitted record. — js/service_worker.js:19425-19443
Triggers from chrome.tabs.onUpdated for HTTP pages whenever Safe Search is not explicitly disabled. — js/service_worker.js:19543-19546
Does it create a persistent ID or browser fingerprint to recognize you?
It creates a random UUID, stores it indefinitely as userId, and attaches it to browsing records. That lets the operator link visits into a continuing browser profile.
Loads an existing userId or creates and stores a random UUID. — js/service_worker.js:19561-19571
Includes that persistent userId beside the previous and current URL in each record. — js/service_worker.js:19425-19431
Does it send cookies, session details, authentication data, or page contents elsewhere?
It does not read browser cookies or saved passwords, but it sends full URLs. If a site places session tokens, email addresses, private document IDs, searches, or other page data in a URL, those values are included in the telemetry.
No cookies permission is requested. — manifest.json:permissions
Copies unredacted tab URLs into the transmitted record without stripping query strings or fragments. — js/service_worker.js:19311-19356 and 19425-19443
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Sentry initialization sets error sampling but does not enable replay sampling or a replay integration. — js/service_worker.js:18472-18487
No clipboard, desktopCapture, or tabCapture permission is declared. — manifest.json:permissions
Can a website or remote server send commands that make the extension take actions?
The adblox.org install services can direct the extension to open any returned URL. The telemetry services's response is ignored, and I found no server command that can directly inject scripts or alter filter rules after installation.
Trusts response.response.url from the server and opens it with tabs.create. — js/service_worker.js:19631-19639
Parses but otherwise ignores the Safe Search POST response. — js/service_worker.js:19301-19310
Does it alter links, referral codes, advertisements, shopping carts, or search results?
No evidence of this behavior was found in the reviewed package.
No declarative rule has an action.redirect.url pointing to a remote HTTP or HTTPS destination. — rulesets/**/*.json:redirect action review
The custom content script hides elements matching user cosmetic rules and does not insert links or ads. — js/content.js:1-29
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It extensively blocks, allows, redirects, removes URL parameters, modifies headers, and injects cosmetic rules using packaged ad-block lists. These changes implement its advertised blocker; it does not configure a browser proxy or control file downloads.
Contains roughly 55,670 block, 7,305 allow, 2,697 redirect, and 147 modifyHeaders actions. — rulesets/**/*.json:packaged DNR actions
Requests declarativeNetRequest and webRequest but not proxy or downloads. — manifest.json:permissions
Can it communicate with software on the computer or services running on localhost?
No evidence of this behavior was found in the reviewed package.
No nativeMessaging permission is declared. — manifest.json:permissions
No localhost, loopback, native-host, or executable-launch endpoint was found. — js/*.js:endpoint review
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
Imports the literal AES key, encrypts the JSON record, combines IV and ciphertext, and Base64-encodes it. — js/service_worker.js:19231-19299
Sends the encoded value as data to the Safe Search endpoint. — js/service_worker.js:19301-19310
Can ordinary websites access privileged extension features through messaging or exposed files?
No evidence of this behavior was found in the reviewed package.
Registers onMessageExternal and handles setFilteringMode/disableTabFiltering without inspecting the sender. — js/service_worker.js:19129-19175 and 19208-19210
No externally_connectable webpage origins are declared. — manifest.json:top-level keys
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior varies with filter mode, allowlists, enabled regional lists, chosen cosmetic rules, tab state, and the default-on Safe Search setting. I found no time bomb or geographic trigger, but URL telemetry is concealed behind a vague optional-feature label.
Controls blocking state, allowlist, element hiding, and Safe Search from the popup. — js/popup.js:18375-18517
The telemetry branch runs unless Safe Search is explicitly false. — js/service_worker.js:19543-19546
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
No mining protocol, wallet, worker farm, hash loop, or compute-job endpoint appears. — js/*.js:bundle review
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
Starts the user-invoked element picker and returns a cosmetic rule string. — js/adblox/startAssistant.js:1-15
Applies matching cosmetic rules by setting display:none. — js/content.js:1-29
No form action assignment, submit listener, or submit invocation was found in active first-party flows. — js/*.js:form API review