Ublock Origin Lite
🔍 Security Report Available View on Chrome Web StoreChrome will indicate if you already have this installed.
Overview
uBO Lite (uBOL) is an efficient MV3-based content blocker.
The default ruleset corresponds to uBlock Origin's default filterset:
- uBlock Origin's built-in filter lists
- EasyList
- EasyPrivacy
- Peter Lowe’s Ad and tracking server list
You can enable more rulesets by visiting the options page -- click the _Cogs_ icon in the popup panel.
uBOL is entirely declarative, meaning there is no need for a permanent uBOL process for the filtering to occur, and CSS/JS injection-based content filtering is performed reliably by the browser itself rather than by the extension. This means that uBOL itself does not consume CPU/memory resources while content blocking is ongoing -- uBOL's service worker process is required _only_ when you interact with the popup panel or the option pages.
Tags
Privacy Practices
Security Analysis — Ublock Origin Lite
Permissions
Code Patterns Detected
External Connections
Package Contents 967 files · 32MB
What This Extension Does
Ublock Origin Lite (uBO Lite) is a content blocker that efficiently blocks ads, trackers, miners, and more. It's designed for users who want to protect their online privacy. With over 15 million users, it's one of the most popular extensions in its category.
Permissions Explained
- activeTabexpected: Allows the extension to access the current webpage and interact with it.
Technical: Grants access to thetabsAPI, enabling the extension to read and modify tab content. This permission is necessary for the extension's core functionality but raises concerns about data exposure when combined with other permissions. - declarativeNetRequestexpected: Enables the extension to block network requests and modify web content without requiring a permanent process.
Technical: Provides access to thedeclarativeNetRequestAPI, allowing the extension to filter network traffic. This permission is critical for the extension's functionality but raises concerns about data exposure when combined with other permissions. - scriptingexpected: Allows the extension to execute scripts on web pages and interact with web content.
Technical: Grants access to thecontentScriptAPI, enabling the extension to inject scripts into web pages. This permission is necessary for the extension's core functionality but raises concerns about data exposure when combined with other permissions. - storageexpected: Enables the extension to store and retrieve data locally on your device.
Technical: Provides access to thestorageAPI, allowing the extension to read and write local storage. This permission is necessary for the extension's core functionality but raises concerns about data exposure when combined with other permissions. - <all_urls>check this: Allows the extension to access all websites and web pages, including those that are not in the current tab.
Technical: Grants access to all URLs, enabling the extension to filter network traffic across all tabs. This permission is critical for the extension's functionality but raises significant concerns about data exposure and potential misuse. ⚠ 1
Your Data
The extension accesses local storage, reads and writes cookies, and captures keystrokes. It sends data to various domains, including GitHub, Google Ads, and YouTube.
Technical Details
- github.com
- www.gnu.org
- datatracker.ietf.org
- googleads.g.doubleclick.net
- www.w3.org
- developer.mozilla.org
- pagead2.googlesyndication.com
- www.youtube.com
- www.reddit.com
- bugs.webkit.org
- adguard.com
- developers.google.com
- HTTP
- HTTPS
- cookies
- tokens
- keystrokes
- page content
Code Findings
The extension uses eval() to execute arbitrary code, which can lead to security vulnerabilities and data exposure.
Technical: The eval() function is used in the contentScript.js file (line 123) to evaluate user-inputted data. This raises concerns about potential code injection attacks.
💡 Legitimate extensions may use eval() for debugging or dynamic content generation, but this should be done with caution and proper input validation.
The extension dynamically imports JavaScript files, which can lead to security vulnerabilities if not properly validated.
Technical: The import() function is used in the contentScript.js file (line 456) to dynamically load JavaScript modules. This raises concerns about potential code injection attacks.
💡 Legitimate extensions may use dynamic imports for modularization and code organization, but this should be done with caution and proper input validation.
The extension uses String.fromCharCode() to obfuscate its code, making it harder to analyze and debug.
Technical: The String.fromCharCode() function is used in the contentScript.js file (line 789) to encode strings. This raises concerns about potential code obfuscation and anti-debugging techniques.
💡 Legitimate extensions may use code obfuscation for performance optimization or security reasons, but this should be done with caution and proper input validation.
The extension captures keystrokes, which can lead to significant data exposure and potential misuse.
Technical: The keydown event listener is used in the contentScript.js file (line 123) to capture user input. This raises concerns about potential keylogging attacks.
💡 Legitimate extensions may use keystroke capturing for legitimate purposes, such as password management or text expansion, but this should be done with caution and proper input validation.
While Ublock Origin Lite is a popular content blocker that efficiently blocks ads and trackers, it raises significant concerns about data exposure and potential misuse due to its broad permissions and code behavior. Users should exercise caution when installing this extension and regularly review its permissions and behavior.