Is Ad Blocker Pro - block ads ad blocker safe?
We analyzed Ad Blocker Pro - block ads ad blocker version 2.4's actual code and gave it a 62/100 trust score. This is a broadly empowered ad blocker with…
Bottom line
This is a broadly empowered ad blocker with limited tracking and remote rule updates, but no established theft of passwords, sessions, or page contents.
What it can access
The extension can inspect or change pages and web traffic across all websites, which supports ad blocking but gives it broad reach beyond a single site.[Q2] It also automatically redirects or blocks matching requests.[Q17]
Signs of misuse
It sends search timing, domain-level blocking statistics, and a persistent installation identifier to its provider, allowing activity to be correlated over time.[Q6][Q12][Q13] The review found no evidence that it sends cookies, authentication data, or page contents.[Q14]
Code findings
What access does this extension ask for, and does that access make sense for what it claims to do?
It can inspect and alter web pages and network requests across essentially all websites, which supports ad blocking but is broader access than the stated feature strictly needs.
The extension requests <all_urls>, scripting, activeTab, tabs, webRequest, and declarativeNetRequest access, allowing broad page and network interaction. — manifest.json:1
The stated purpose is blocking advertisements, so page and request filtering are relevant, but the all-site scope is extensive. — manifest.json:1
Which websites can it run on, and can it read or change what appears on those pages?
It can read or change pages on broadly matched websites after any required approval.
Host permissions allow requests or privileged browser access, sometimes after later approval, for: <all_urls> — manifest.json:1
The scripting permission allows code injection on approved host-permission sites. — manifest.json:1
activeTab grants temporary access to the current page after a user action. — manifest.json:1
Can it see sensitive information you type, such as passwords, payment details, messages, or form entries?
The reviewed extension has page-facing scripts and can inspect or modify page content, but no complete path was established that reads passwords, payment details, messages, or submitted form values and sends them anywhere. Detecting or masking page fields alone would not prove collection.
The service worker is the runtime entry point, but the supplied material does not establish a sensitive-form collection path. — abp_service_worker.js:1
The file is bundled and minified; the cited hooks do not by themselves prove that typed values are collected or exfiltrated. — abp_main.js:1
Can it access private browser data such as cookies, signed-in sessions, browsing history, bookmarks, or downloads?
No code evidence shows direct access to cookies, browsing history, bookmarks, downloads, or browser website sessions. The listed permissions do not include cookies, history, bookmarks, or downloads.
Permissions list does not include cookies, history, bookmarks, or downloads. — manifest.json:15-23
Uses extension storage and tab metadata for ad-blocking statistics, but no browser-cookie or history API access is shown. — abp_service_worker.js:1
Can it access anything else on your device, such as files, location, camera, microphone, clipboard, or installed applications?
No evidence was found in the manifest or package for this capability.
Does it send information outside your browser? If so, what information is sent, where does it go, and why?
The extension sends installation and ad-blocking statistics to proadblocker.com. The reported data includes an installation identifier, extension metadata, blocked-count information, and Google-search timestamps; it is sent for registration, updates, or statistics rather than as page-content data.
The service-worker code contains provider requests for registration, updates, uninstall handling, and statistics, including an iid/inst_id and extension metadata. — abp_service_worker.js:1
Defines the provider base URL as https://proadblocker.com. — abp_config.js:1
Does it download or run code, settings, or instructions supplied by a remote server?
The service worker downloads remote filter and whitelist/configuration data and applies it to the extension. The established behavior is remote settings and declarative rules, not proof that arbitrary downloaded JavaScript is executed.
The service worker contains fetch/update processing and applies downloaded rule or whitelist data. — abp_service_worker.js:1
The packaged declarative rule resources are enabled at installation, while the service worker can update dynamic rules. — manifest.json:35-64
Can it take actions without a clear user request, such as opening pages, redirecting searches, downloading files, or sending requests?
It performs background network and rule-management actions without a fresh click, including scheduled updates/statistics and automatic request blocking or redirection. It also opens a page on installation, which is event-driven rather than a recurring action on every page.
The service worker registers installation and alarm-driven work, including provider requests and update processing. — abp_service_worker.js:1
Enabled declarative rule resources can automatically block or redirect matching requests. — manifest.json:35-64
Can it change important browser settings, including your proxy, search engine, homepage, privacy settings, or other extensions?
No evidence was found in the manifest or package for this capability.
Is any important behavior difficult to inspect because the code is hidden, heavily obfuscated, dynamically generated, or supplied by third parties?
Important behavior is difficult to inspect because core scripts are bundled into large minified files and the extension relies on large rule datasets and remotely updated settings. This is an auditability concern, not evidence that the code is malicious.
The core page-facing script is a large single-line bundled/minified file. — abp_main.js:1
The service worker is also bundled/minified and contains update and runtime logic. — abp_service_worker.js:1
Many web-accessible resources and large filter datasets are exposed or loaded as extension assets. — manifest.json:35-64
Does it use eval(), new Function(), or string-based timers to turn text into executable code?
The bundled page-facing code contains string-to-code-related mechanisms, including interception or replacement of page eval/timer behavior and dynamically constructed callbacks or regular expressions. The evidence supports use of these mechanisms, but not that untrusted remote text is executed as extension code.
The cited bundled code contains eval/setTimeout-related hooks and generated scriptlet machinery. — abp_main.js:1
Does it track the websites, pages, searches, or links you visit?
The extension records limited browsing-related events for ad-block statistics, including Google-search timestamps and per-domain blocking counts, and later sends those statistics to its provider. It is not shown to collect a complete browsing history or page contents.
The protection runtime reports a Google-search event to the extension runtime. — abp_protection.js:1
The service worker stores search timestamps and ad-block statistics and includes them in provider statistics requests. — abp_service_worker.js:1
Does it create a persistent ID or browser fingerprint to recognize you?
The extension obtains and stores an installation identifier and reuses it in provider requests. This supports recognizing the extension installation over time, but the reviewed evidence does not establish a browser fingerprint.
The service-worker registration/update/statistics paths use a stored iid or inst_id. — abp_service_worker.js:1
The extension defines provider configuration for proadblocker.com. — abp_config.js:1
Does it send cookies, session details, authentication data, or page contents elsewhere?
The reviewed code sends extension-generated installation, version, rule, and blocking statistics to proadblocker.com, but no website cookies, page contents, or authentication data were found being collected or uploaded.
Registration uses credentials for the extension's own service and sends only version and extension ID in the body. — abp_service_worker.js:1
Statistics upload contains blocking statistics, installation ID, search timestamps, and extension ID. — abp_service_worker.js:1
Does it record typing, form entries, clipboard contents, or screenshots?
No code was found that records keystrokes, form entries, clipboard data, or screenshots. The source does inspect and modify page scripts and DOM-related behavior for ad blocking, but that is not evidence of recording those contents.
Hooks page APIs such as XMLHttpRequest and DOM behavior for filtering; no typing, clipboard, or screenshot collection was identified. — abp_main.js:1
Can a website or remote server send commands that make the extension take actions?
Remote servers can influence the extension through downloaded filters, whitelist data, and settings, which can alter blocking and page behavior. The reviewed evidence does not prove that a website can directly issue arbitrary privileged commands to the extension.
The service worker processes remote update material and applies rules/settings. — abp_service_worker.js:1
The extension has declarative rule resources and broad host access, but capability alone does not prove a website-controlled command path. — manifest.json:35-64
Does it alter links, referral codes, advertisements, shopping carts, or search results?
Its filtering rules alter web requests, including redirecting selected advertising or tracking resources and removing selected query parameters. The demonstrated purpose is ad and tracker blocking rather than affiliate manipulation.
Contains declarative redirect rules to extension-provided replacement resources. — default.json:1
Removes the `vid` query parameter from matching requests. — default_1.json:1
Removes the `user_id` query parameter from matching requests. — default_4.json:1
Does it redirect or modify web traffic, request headers, downloads, or proxy settings?
The extension automatically modifies web traffic by blocking or redirecting requests that match its declarative rules. The evidence does not establish proxy-setting changes or theft of request headers; webRequest observation alone is not header exfiltration.
The extension requests broad host access, declarativeNetRequest, and webRequest permissions. — manifest.json:12-23
The packaged rules contain blocking and redirect actions. — default.json:1
The service worker observes request errors for statistics/coordination; no confirmed outbound header-copying sink is shown. — abp_service_worker.js:1
Can it communicate with software on the computer or services running on localhost?
No native-messaging connection, localhost request, or other communication with local computer software was found in the reviewed source.
The manifest has no nativeMessaging permission. — manifest.json:15-23
Observed network endpoints are proadblocker.com and extension-local resources, not localhost services. — abp_service_worker.js:1
Does it decode, decrypt, or unpack hidden data and then execute or inject it?
The reviewed material establishes bundled scripts and remotely downloaded rule/settings data, but not decoding or decrypting hidden data followed by execution or injection. Rule-driven scriptlets and page hooks are not, by themselves, proof of an unpack-and-execute pipeline.
Remote update processing is described as rules/settings installation; a confirmed decode/decrypt-to-code sink was not established. — abp_service_worker.js:1
Bundled page hooks and generated callbacks do not prove that hidden remote data is unpacked and executed. — abp_main.js:1
Can ordinary websites access privileged extension features through messaging or exposed files?
Ordinary websites can request the manifest's web-accessible images, scripts, and filter files, but that does not give them privileged extension APIs. The reviewed material does not establish an untrusted page-to-service-worker messaging path that bypasses sender or context controls.
Web-accessible resources are available to matching web pages, including the resource directory and filters. — manifest.json:35-64
The cited message handling is not sufficient to prove that arbitrary ordinary pages can invoke privileged operations. — abp_service_worker.js:1
Does suspicious behavior activate only for certain users, websites, dates, or remote settings?
Behavior varies with the current website, matching filter rules, whitelist state, installation events, and periodic remote updates. These conditions can change whether blocking, page-specific scripts, statistics, or update actions run.
The configuration includes website-specific matching and YouTube-related scripts/whitelist values. — abp_config.js:1
The service worker has alarm/update and installation-state logic that changes runtime behavior over time. — abp_service_worker.js:1
Rule resources determine behavior only for matching requests and sites. — manifest.json:35-64
Does it perform hidden resource-intensive work, such as cryptocurrency mining?
No cryptocurrency-mining code or other deliberately hidden heavy computation was identified. The extension does perform filtering, script injection, periodic updates, and statistics processing, but these are related to its stated function.
Periodic alarms handle rule updates and statistics; no mining workload or coin-mining endpoint was identified. — abp_service_worker.js:1
Does it change form fields or where a form sends its information?
No code was found that changes form fields or redirects submitted form data. The network rules remove selected tracking parameters from requests, but that is not demonstrated form tampering.
Removes a query parameter from matching requests. — default_1.json:1
Removes a `user_id` query parameter from selected requests; no form-field or form-action modification is shown. — default_4.json:1