Is Total Adblock - Ad Blocker safe?
We analyzed Total Adblock - Ad Blocker version 5.13.0's actual code and gave it a 55/100 trust score. This is a powerful ad blocker with broad access and…
Bottom line
This is a powerful ad blocker with broad access and intrusive publisher promotions, but no evidence of password theft or dangerous remote code execution.
What it can access
It can modify every website and access cookies, browsing data, tabs, and network activity, exceeding the narrowest ad-blocking needs. [Q1][Q4][Q5][Q18]
Security weaknesses
All-sites access also reaches local and private-network pages, while approved publisher websites can authenticate the extension through a privileged channel. [Q19][Q21]
Signs of misuse
The extension sends account and analytics data to its publisher and injects targeted sales promotions into unrelated pages, conflicting with its ad-blocking purpose. [Q6][Q17][Q22]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It has broad access to every website, browser tabs, cookies, requests, navigation, stored data, notifications, content settings, and browsing-data deletion.
Requests scripting, browsingData, contentSettings, cookies, notifications, storage, tabs, unlimitedStorage, webRequest, declarativeNetRequest, webNavigation, and <all_urls>. — manifest.json:251-267
Loads several content-script stacks on all HTTP and HTTPS pages, including the blocker in every frame and the promotional injection layer in top frames. — manifest.json:143-249
Which websites can it run on, and can it read or change what appears on those pages?
It changes pages to block ads and trackers, and it also injects Total Adblock sales banners, notices, rating prompts, and other promotional cards into ordinary sites.
Applies AdGuard cosmetic rules, scriptlets, and page-level filtering across matching pages and frames. — app/adblock_content/adblock_content.min.js:1
Registers injectable content for flash sales, limited offers, upgrade banners, account setup, achievements, rating prompts, YouTube notices, and other product cards. — app/background/background.min.js:1
Runs the injectable-content dispatcher at document_end on every HTTP and HTTPS page. — manifest.json:217-228
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
No evidence of this behavior was found in the reviewed package.
The all-sites dispatcher injects fixed product UI; it does not query page forms, inputs, payment fields, or password fields. — app/injectable_content/injectable_content.min.js:1
Password and submit handling is part of the extension's own login/account React components, not a webpage credential collector. — app/shared/shared.min.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
It reads selected Total Adblock and TotalAV cookies to sign the extension into the user's publisher account and to retain signup attribution. No unrelated-site cookie enumeration was found.
Reads named LC cookies on www.totaladblock.com and www.totalav.com for cookie-based authentication. — app/background/background.min.js:1
Reads named FRT:ADVTD and FRT:LANDER brand-domain cookies for advertising and landing-source metadata. — app/background/background.min.js:1
Declares cookies and <all_urls>, giving broader technical reach than the reviewed first-party cookie calls use. — manifest.json:251-267
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
It can erase the user's browser history, cache, and download history through an internal clear-data command. It has no camera, microphone, geolocation, native-messaging, or general file access.
Requests the browsingData permission. — manifest.json:251-264
The clear_browsing_data handler can call removeHistory, removeCache, and removeDownloads from time zero according to user-selected flags. — app/background/background.min.js:1
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
It sends account details, a stable client ID, product metadata, timestamps, authentication material, and extension-page analytics to publisher services. Normal browsing URLs were not found in those outbound requests.
Vendor API requests to totaladblock.protected.net can include X-Email, a stored UUID client ID, Unix time, platform, app version, and signed authentication data. — app/background/background.min.js:1
On first install it submits a generated provisional account and later sends authentication, user-status, plan, datastore, rating, SSO, and notification requests. — app/background/background.min.js:1
Matomo sends extension-page visits to stats.totalav.com using a persistent visitor ID; query values are hashed before reporting. — app/shared/shared.min.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
Publisher responses supply account status, plan state, notification content, SSO links, and upgrade destinations that change the extension's UI and sales behavior, but they are not executed as code.
Calls /v1/user, /v1/user/status, /v1/plan, /v1/user/sso, /v1/datastore, /v1/rating, and /v1/notification/request and stores or displays returned state. — app/background/background.min.js:1
Account state controls paid/expired behavior, upgrade prompts, filtering state, and product notifications. — app/background/background.min.js:1
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
The blocker, account polling, active-tab tracking, and promotion checks run automatically in the background or on page loads. Startup can also open an upgrade tab for unpaid users.
Starts a service worker and injects blocker and product UI content scripts automatically across all sites. — manifest.json:140-228
Polls logged-in account updates every ten minutes and evaluates injectable-content conditions as pages load. — app/background/background.min.js:1
Browser-startup logic opens the upgrade URL for an existing unpaid user, with a stored limit of three openings per day. — app/background/background.min.js:1
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence of this behavior was found in the reviewed package.
Declares no chrome_settings_overrides, chrome_url_overrides, proxy, privacy, management, debugger, or search-provider capability. — manifest.json:1-268
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
The unpacked extension is about 146 MB and relies on very large minified shared bundles plus generated filter rules, making independent review materially harder.
Records 146,188,889 unpacked bytes, including a roughly 9.3 MB minified vendor bundle and several filter rulesets larger than 20 MB. — inventory.json:1
Combines many third-party libraries and duplicated runtime code into a single minified line. — app/vendor/vendor.min.js:1
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
No evidence of this behavior was found in the reviewed package.
Uses chrome.scripting.executeScript in the MAIN world to run scriptlets and scripts derived from packaged AdGuard filter data and redirect resources. — app/adblock_content/adblock_content.min.js:1
The packaged Lottie expression engine builds _expression_function from animation expression text and evaluates it; webpack also contains a standard new Function global-object fallback. — app/vendor/vendor.min.js:1
A packaged AdGuard redirect resource replaces eval with a no-op on matched pages rather than fetching code. — web-accessible-resources/redirects/noeval.js:1-20
Does it track the websites, pages, searches, or links you visit?
No evidence of this behavior was found in the reviewed package.
The AdGuard content layer processes the current page, frames, request context, cosmetic rules, and user events needed for filtering. — app/adblock_content/adblock_content.min.js:1
Stores the active tab and blocked-item statistics for UI and filtering state; reviewed network clients do not submit that browsing state. — app/background/background.min.js:1
Matomo page-view calls originate from extension application routes, not the ordinary all-sites content scripts. — app/shared/shared.min.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
It creates persistent identifiers for the publisher services and analytics and can associate them with an account email and subscription state.
Stores a UUID client ID and includes it with account API metadata and authentication state. — app/background/background.min.js:1
Creates and stores a separate 16-character Matomo visitor ID under analytics:visitor_id. — app/shared/shared.min.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
Account email, authentication tokens, generated signup credentials, and attribution data are sent to the intended publisher services. Page passwords, form values, and general browsing URLs were not found leaving the browser.
Authentication and provisional-signup flows send credentials and account identity to totaladblock.protected.net and retain returned auth state. — app/background/background.min.js:1
API headers include stable client and account metadata; reviewed request construction does not add active-tab URLs or page contents. — app/background/background.min.js:1
The ordinary-page injection layer does not capture page forms, text, or credentials for transmission. — app/injectable_content/injectable_content.min.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No evidence of this behavior was found in the reviewed package.
Requests none of the clipboard, desktopCapture, tabCapture, audioCapture, videoCapture, or nativeMessaging permissions. — manifest.json:251-267
All-sites first-party UI code has no input, keylogging, clipboard, media-capture, or screenshot collection path. — app/injectable_content/injectable_content.min.js:1
Can a website or remote server send commands that make the extension take actions?
Approved Total Security websites can query whether the extension is installed and send an authentication token that signs the extension into an account.
Allows external connections from TotalAV, Total Adblock, Total Password, Total Drive, Total Browser, Total WebShield, and Total VPN domains and subdomains. — manifest.json:88-105
The external RPC server exposes is_installed and auth_with_token; the latter passes the supplied token into cookie/token authentication. — app/background/background.min.js:1
Does it alter links, referral codes, advertisements, shopping carts, or search results?
It injects the publisher's own advertising and upgrade prompts into unrelated webpages and opens upgrade pages, even though the product is sold as an ad blocker.
Registers FlashSaleNotification, LimitedOfferNotification, UpgradeBanner, expired-user benefits, achievements, review prompts, and other product promotional injectables. — app/background/background.min.js:1
Renders a timed flash-sale notification for eligible free users after the install delay and again after a stored cooldown. — app/flash_sale_notification/flash_sale_notification.min.js:1
Renders a limited-time discount notification on ordinary pages for eligible free users. — app/limited_offer_notification/limited_offer_notification.min.js:1
Can open a publisher upgrade URL in a new tab on browser startup for unpaid users. — app/background/background.min.js:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
It intercepts, blocks, redirects, and cosmetically changes web traffic through packaged AdGuard filters and Chrome's declarative network rules. This is its advertised core function.
Declares fifteen packaged declarativeNetRequest rulesets. — manifest.json:4-82
Requests webRequest, declarativeNetRequest, webNavigation, scripting, and <all_urls>. — manifest.json:251-267
Initializes the packaged AdGuard MV3 engine, selects static filter lists, and manages dynamic/session rules and filtering state. — app/background/background.min.js:1
Can it communicate with software on the computer or services running on localhost?
Its all-sites access includes reachable localhost and private-network pages, where it can inspect and block requests or inject page UI. It has no native-messaging access.
The http://*/* and https://*/* content-script matches do not exclude localhost or private address space. — manifest.json:143-228
Host permissions are <all_urls>, while nativeMessaging is absent. — manifest.json:251-267
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
No evidence of this behavior was found in the reviewed package.
AdGuard filtersPath, ruleSetsPath, redirects, and scriptlets resolve under packaged extension asset paths. — app/background/background.min.js:1
Remote API responses update account, plan, datastore, SSO, rating, or notification state; no response text reaches eval, Function, importScripts, or executable Blob creation. — app/background/background.min.js:1
The confirmed eval path belongs to the packaged animation-expression engine and is not fed by a reviewed network response. — app/vendor/vendor.min.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Publisher-controlled websites have a privileged external channel into the extension, and injected extension iframes exchange layout messages with their parent page. Ordinary sites cannot invoke account authentication through the Chrome channel.
externally_connectable restricts Chrome external messages to enumerated Total Security domains and subdomains. — manifest.json:88-105
The external RPC channel accepts is_installed and auth_with_token from manifest-approved origins. — app/background/background.min.js:1
Injected extension iframes use wildcard postMessage channels for viewport sizing and wrapper removal; these messages do not expose account, storage, or network operations. — app/serve_injectable_content/serve_injectable_content.min.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Promotions are selectively triggered by free or expired account status, time since installation, page context, dismissal cooldowns, and stored display counts. No victim-specific covert data was found.
Injectable eligibility checks use paid/expired state, install age, last display or dismissal time, current page, and rotation/cooldown data. — app/background/background.min.js:1
Free eligible users can receive a flash-sale prompt after an initial delay and then after a 48-hour cooldown. — app/flash_sale_notification/flash_sale_notification.min.js:1
A separate limited-offer promotion becomes eligible after an install-age threshold and displays a countdown. — app/limited_offer_notification/limited_offer_notification.min.js:1
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No evidence of this behavior was found in the reviewed package.
Long-running components are the AdGuard filtering engine, account/status polling, extension UI state, and notification scheduling. — app/background/background.min.js:1
Declares no vpnProvider, proxy, nativeMessaging, or socket capability. — manifest.json:251-267
Does it change form fields or where a form sends its information?
No evidence of this behavior was found in the reviewed package.
The ordinary-page dispatcher controls extension containers and iframes; it has no query, listener, or mutation targeting existing form, input, password, action, or formAction values. — app/injectable_content/injectable_content.min.js:1
Form-related matches are React/router and extension-UI framework code; no first-party all-sites call changes a host page's form destination. — app/vendor/vendor.min.js:1