Is uBlock Origin safe?
We analyzed uBlock Origin version 1.75.0's actual code and gave it a 68/100 trust score. uBlock Origin has very broad browser access for blocking ads and…
Bottom line
uBlock Origin has very broad browser access for blocking ads and trackers, but the supplied evidence shows no clear misuse.
What it can access
The extension can inspect and alter pages and network traffic across HTTP, HTTPS, and file pages, and it can change privacy-related settings.[Q2][Q9][Q18] This is powerful access, but it is broadly consistent with blocking advertisements and trackers.[Q17][Q18]
Signs of misuse
The extension downloads filter rules and observes browsing activity locally for blocking and diagnostics.[Q6][Q7][Q12] The supplied evidence does not show those data being sent to outside trackers, nor arbitrary remote code execution or sensitive-data collection.[Q7][Q14][Q15]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It requests broad access across websites, network traffic, browser privacy settings, tabs, and local files; this is powerful but broadly consistent with an ad and tracker blocker.
The manifest requests alarms, DNS access, menus, privacy settings, storage, tabs, web navigation, blocking and modifying web requests, unlimited storage, and access to all URLs. — manifest.json:1
Content scripts run in all frames on HTTP, HTTPS, and file pages, allowing page inspection and modification. — manifest.json:1
The traffic engine can block, redirect, and modify selected web requests and response headers. — js/traffic.js:request filtering and redirect handling
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
Content scripts run directly on: http://*/*, https://*/*, file://*/*, https://easylist.to/*, https://*.fanboy.co.nz/*, https://filterlists.com/*, https://forums.lanik.us/*, https://github.com/* — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The extension’s content scripts run on ordinary pages and inspect or modify page structure for filtering, so they can encounter form elements. The reviewed code does not establish that typed passwords, payment details, messages, or ordinary form values are read or transmitted, but the available source coverage is not sufficient for a definitive negative answer.
The main content script runs at document_start in all frames on HTTP, HTTPS, and file pages. — manifest.json:content_scripts entry for /js/contentscript.js
The content script observes and changes page DOM content, but the cited behavior does not itself show collection of input values. — js/contentscript.js:page-DOM filtering code
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No source evidence was found that it reads cookies, browsing history, bookmarks, or downloads. Its webRequest and tabs permissions support request filtering and tab handling, but the traced code does not show extraction of those private browser databases.
The manifest requests tabs, webRequest, webNavigation, and storage, but not cookies, history, bookmarks, or downloads. — manifest.json:49-66
The traced webRequest setup registers request and response filtering observers. — js/traffic.js:1344-1359
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends requests outside the browser to download and update filter lists and related assets. The traced asset code fetches externally configured text resources, primarily filter lists, rather than transmitting browsing contents or form data to an analytics service.
External asset URLs are fetched, with cache-bypass parameters sometimes added. — js/assets.js:330-361
Configured external sources include uBlock Origin-hosted filter resources and CDN mirrors. — assets/assets.json:88-95
EasyPrivacy filter lists are configured to be downloaded from uBlock/CDN sources. — assets/assets.json:236-241
Does it download or run code, settings, or instructions supplied by a remote server?
The extension downloads remote filter-list and update data and incorporates that data into its filtering configuration. This is remote-supplied settings or instructions, not evidence that arbitrary remote JavaScript is installed and executed as extension code.
Remote assets are fetched and processed as text-like resources, with response validation. — js/assets.js:asset-fetch and update handling
Startup loads filter-list assets and registers update checks and observers. — js/start.js:asset initialization and update setup
The packaged asset configuration identifies remote list sources used by the extension. — assets/assets.json:asset definitions
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It can take automatic background actions such as observing and blocking network requests, altering responses, injecting scripts, and reloading tabs. Opening dashboards, loggers, or other tabs is tied to commands or extension UI actions rather than arbitrary browsing behavior.
Network observers are installed for HTTP and HTTPS requests, including blocking/response-header handling. — js/traffic.js:1353-1368
The background side can execute scriptlets in tabs. — js/messaging.js:129-135
It can replace or reload tabs in response to extension messages. — js/messaging.js:203-215
Tab opening, reloads, and filtering changes are implemented for explicit extension commands. — js/commands.js:122-175
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
It can change browser settings or manage installed extensions through: privacy.
The manifest requests setting-related permissions: privacy — manifest.json:1
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Some behavior is indirect because filter lists select scriptlets and resources at runtime, and the package includes large bundled assets and third-party resources. The inspected code is not shown to be heavily obfuscated, but the available coverage does not prove that every dynamically selected resource is easy to audit.
Runtime messages and rule data can select scriptlet-related resources by name. — js/messaging.js:scriptlet/resource selection and dispatch
Downloaded assets become inputs to extension behavior. — js/assets.js:remote asset incorporation
Bundled filtering modules are loaded and compiled during startup. — js/start.js:WASM initialization
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No active use of eval(), new Function(), or string-based timers was demonstrated in the inspected runtime code. Search results included documentation, filter data, and resource names, which are not proof that the extension executes those constructs.
The eval() occurrence is in explanatory text describing an optional expression feature, not a demonstrated call in the inspected line. — js/jsonpath.js:36-36
The resource discusses preventing fetch calls; it does not demonstrate eval or string-based timer execution. — js/resources/prevent-fetch.js:133-169
Does it track the websites, pages, searches, or links you visit?
The extension observes web requests and related response events to decide what to block and to populate its local logger and per-tab filtering state. This is local operational monitoring for blocker functionality, not evidence that a browsing history is sent to an external tracker.
The traffic layer handles requests, redirects, response headers, completions, and errors. — js/traffic.js:request and response event handlers
Filtering state is maintained in association with browser tabs and pages. — js/pagestore.js:per-tab network state
Network activity can be made available to the extension’s local logger. — js/logger.js:logger integration
Does it create a persistent ID or browser fingerprint to recognize you?
The code creates short-lived random tokens to connect a page script to the extension, but no persistent tracking identifier or browser-fingerprint collection was found.
Creates a random token and assigns it to vAPI.sessionId for extension messaging. — js/vapi-client.js:39-48
Does it send cookies, session details, authentication data, or page contents elsewhere?
The extension inspects requests for blocking and logging, but the reviewed code does not show cookies, authentication data, or page contents being sent to an outside service.
Builds filtering context and records request decisions locally. — js/traffic.js:55-85
Temporarily stores request headers keyed by request ID for local request handling, then removes them on completion or error. — js/traffic.js:1311-1334
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records keystrokes, form entries, clipboard contents, or screenshots. Clipboard-related resources are aimed at preventing clipboard writes, not collecting clipboard data.
The bundled resource is explicitly named and intended to prevent clipboard writes. — js/resources/prevent-clipboard-write.js:1-20
The content script documentation describes DOM watching and filtering rather than input capture. — js/contentscript.js:36-57
Can a website or remote server send commands that make the extension take actions?
Web pages can message the extension for normal blocker operations, but no evidence here shows a remote server issuing arbitrary commands to the extension.
Messaging distinguishes privileged ports from ordinary page/content-script ports. — js/messaging.js:62-66
The default message handler processes defined extension requests such as asset lookup and filter-list lookup. — js/messaging.js:95-120
Does it alter links, referral codes, advertisements, shopping carts, or search results?
uBlock Origin intentionally alters page behavior by blocking or redirecting matching network requests and applying cosmetic filters. This is ad/tracker blocking, not affiliate or shopping manipulation.
Filters requests and returns redirect responses when a matching local redirect is selected. — js/traffic.js:83-95
Content scripts watch and filter page DOM elements. — js/contentscript.js:36-57
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension uses webRequest permissions and its traffic engine to block, redirect, and modify selected web requests and response headers. This is its primary ad- and tracker-blocking function; the reviewed code does not establish that it changes the browser’s proxy settings.
The extension requests webRequest, webRequestBlocking, and <all_urls>. — manifest.json:permissions entry
The traffic engine evaluates requests and can cancel or redirect them according to local rules. — js/traffic.js:request filtering and redirect handling
Blocking listeners process request and response metadata, including headers. — js/traffic.js:request/response listener registration
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost communication, or computer-software invocation was found in the reviewed source.
The permission list contains no nativeMessaging permission. — manifest.json:112-129
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The package loads bundled compressed or WebAssembly filtering resources, but the reviewed execution path uses them as the extension’s local filtering engine. There is no established path showing hidden data being decrypted or unpacked and then used to inject arbitrary code.
Bundled filtering modules are fetched from the extension package and compiled for local use. — js/start.js:WASM loading and compilation
Local packaged resources are loaded for the filtering implementation. — js/storage.js:WASM/resource loading
Resources support filtering redirects; this does not establish arbitrary code execution. — js/redirect-engine.js:redirect-resource processing
Can ordinary websites access privileged extension features through messaging or exposed files?
Web pages can host the extension’s content scripts, and those scripts communicate with privileged extension code for intended blocker features. The available evidence does not fully establish whether every message endpoint validates its sender and requested operation, so a broad ordinary-website privilege-escalation claim cannot be confirmed.
Content scripts run on broad HTTP/HTTPS page matches, and selected packaged files are web-accessible. — manifest.json:content_scripts and web_accessible_resources entries
The isolated content script uses extension messaging to request services from privileged code. — js/vapi-client.js:runtime-port messaging
The background side receives runtime connections and dispatches messages; endpoint-specific validation must be assessed per handler. — js/vapi-background.js:runtime connection handling
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
The code has ordinary conditions based on settings, filter rules, page domains, and extension version, but no suspicious user-targeting or remote activation behavior was established.
Version changes trigger local resource maintenance. — js/start.js:139-163
Hidden settings can alter optional filtering-engine behavior. — js/start.js:290-323
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining or other concealed high-resource computation was found. WebAssembly is used for the filtering engine, not mining.
WebAssembly is loaded specifically to initialize static network filtering. — js/start.js:310-322
Does it change form fields or where a form sends its information?
No evidence was found that it changes form fields or form destinations. Its page modifications are focused on filtering ads, trackers, scripts, and DOM elements.
Describes DOM watching, cosmetic filtering, and logging of filtered elements. — js/contentscript.js:36-57
Network changes are request blocking or local resource redirection rather than form rewriting. — js/traffic.js:83-95