Adblock Plus Free Ad Bloc

What This Extension Does

Adblock Plus Free Ad Bloc is a widely used browser extension designed to block intrusive advertisements, trackers, and malicious content across the web. It operates by injecting scripts into every webpage you visit to filter out unwanted elements while allowing users to customize their blocking rules. This report analyzes its permissions and code behavior to determine if it aligns with its stated purpose of enhancing privacy and browsing safety.

Permissions Explained

• <all_urls>expected: This permission allows the extension to run on every website you visit, which is necessary for it to block ads globally. However, it grants broad access to your browsing history and page content.
  Technical: Manifest V3 equivalent for declarativeNetRequest with host access. Grants the ability to inspect and modify network requests on any origin. Attack surface: If compromised, an attacker could read all traffic or inject code into any site.
• webRequestexpected: Enables the extension to intercept and block specific network requests (like ad images) before they load. This is the core mechanism for ad blocking.
  Technical: High-risk permission in Manifest V3 contexts as it allows reading request headers and body content. Attack surface: Can be used to sniff unencrypted traffic or inject malicious payloads if the service worker is compromised.
• tabsexpected: Allows the extension to see information about all tabs, such as their titles and URLs, to manage which sites are being blocked or paused.
  Technical: Accesses chrome.tabs API. Attack surface: Can list open tabs; limited data exposure compared to full tab inspection unless combined with other permissions.
• storageexpected: Used to save your custom filter lists, pause settings, and preferences within the extension itself.
  Technical: Accesses chrome.storage API. Attack surface: Local data storage; generally safe unless malicious code is injected into the extension's own files.
• notificationsexpected: Permits the extension to show pop-up alerts in your browser toolbar, often used for updates or user warnings.
  Technical: Accesses chrome.notifications API. Attack surface: Can be abused by malicious extensions to spam users with phishing links.
• scriptingexpected: Allows the extension to run JavaScript code on web pages to filter content and modify the DOM.
  Technical: Manifest V3 equivalent for 'declarativeNetRequestWithHostAccess' combined with content scripts. Attack surface: High privilege; allows direct manipulation of page elements.
• alarmsexpected: Enables the extension to wake up its background process at specific times to check for updates or perform scheduled tasks.
  Technical: Accesses chrome.alarms API. Attack surface: Minimal; primarily used for polling mechanisms.
• contextMenusexpected: Allows the extension to add custom options to your right-click menu, such as 'Block this site' or 'Pause on this site'.
  Technical: Accesses chrome.contextMenus API. Attack surface: Can be used to inject phishing links into context menus if compromised.
• webNavigationexpected: Helps the extension track when you navigate to a new page to apply filters immediately upon loading.
  Technical: Accesses chrome.webNavigation API. Attack surface: Can monitor navigation history; useful for detecting redirects or tracking attempts.
• contentSettingsexpected: Allows the extension to manage third-party cookie settings and content blocking preferences per site.
  Technical: Accesses chrome.contentSettings API. Attack surface: Can modify browser security settings for specific origins.
• managementexpected: Enables the extension to update itself and manage its own installation status within the browser.
  Technical: Accesses chrome.management API. Attack surface: Limited to self-management; prevents other extensions from uninstalling it without user consent.
• unlimitedStorageexpected: Allows the extension to store large amounts of data locally, such as extensive filter lists and logs.
  Technical: Accesses chrome.storage.local with unlimited quota. Attack surface: Can be used to exfiltrate large datasets if the storage is compromised.

Your Data

The extension accesses your browsing history and page content on every site you visit to filter ads. It sends data to its own servers (adblockplus.org) for updates and account management, as well as to third-party filter list providers like EasyList. While it claims not to collect personal information, the broad <all_urls> permission technically allows access to any data visible in the browser's DOM.

Technical Details

Code Findings