Is Ad Block Genius - stop invasive ads safe?

High risk

Blocks ads, video interruptions, and pop-ups while you browse the web.

This extension uses regularly updated filters to detect and remove unwanted ads, banners, videos, and pop-ups. It runs in the background with a minimal design and no complex settings, and the store description says its site-access permissions support monitoring and modifying web content for ad blocking.

AIvanlabv1.7.2Chrome Web Store
76Risk
Who publishes it

AIvanlab - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
AIvanlab
Registered address
2 Rue Jean Lantier, Paris 75001, FR
Registered contact
AIvanlab
Website
adblock-genius.com/privacy.html

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ad Block Genius uploads your visited-domain list to adblock-genius.com

We observed six uploads to adblock-genius.com carrying the extension's entire stored state: a server-assigned user ID, your allow and block lists, and a per-domain counter that grew to match the sites we browsed.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You load a page in an ordinary browsing tab.

Any site qualifies, and you never open or click the extension.

The extension did this

The extension counts that domain, then uploads its whole stored state, the counter list included, to adblock-genius.com.

The reply overwrites the blocking rules applied to your browser.

Captured request
POSThttps://adblock-genius.com/adbgenius-v1_6.php

HTTP 200, application/json. The returned keys are written back into chrome.storage.sync, including uinfo and ucycle.

Headers
Content-Type
application/json
Body
{  "block": {    "amazon.com": 1,    "edition.cnn.com": 1,    "en.wikipedia.org": 1,    "example.com": 1,    "forbes.com": 1,    "reddit.com": 1  },  "extid": "dkagmnnkfinalebballociekdnlaniem",  "extv": "1.7.2",  "lastUpdateTime": 1756992041887,  "onInstallTabDomains": [    "forbes.com"  ],  "ucycle": 86400000,  "uinfo": "<redacted>",  "whitelistedSites": [],  "foreverBlockedSites": []}
What the upload contains
  • Server-assigned user ID
    uinfo: <redacted>

    Ties every upload back to the same browser profile, so the domain lists join up over time.

  • Per-domain block counts
    block: {"amazon.com":1,"reddit.com":1,"forbes.com":1}

    Names the sites you visited and how many blocks fired on each one.

  • Tabs open at install
    onInstallTabDomains: ["forbes.com"]

    The domains of the tabs you had open the moment the extension was installed.

  • Your allow list
    whitelistedSites: ["news.ycombinator.com"]

    Sites you exempted from blocking, which is itself a list of places you browse.

  • Extension ID and version
    extv: 1.7.2

    Identifies which build is reporting in.

The code that does this

The upload path and the per-domain counter

Readable version

fetchAndStoreUpToDateData()

background.js
async function fetchAndStoreUpToDateData() {  try {    // Get chrome.storage.sync data    const syncData = await chrome.storage.sync.get(null);    const { whitelistedSites, foreverBlockedSites } =      await chrome.storage.local.get([        "whitelistedSites",        "foreverBlockedSites",      ]);    syncData.whitelistedSites = whitelistedSites;    syncData.foreverBlockedSites = foreverBlockedSites;    // Fetch rules and latest popup list only if it might be outdated    const response = await fetch(API_URL_RULES, {      method: "POST",      headers: HEADERS,      body: JSON.stringify(syncData),    });

The per-domain counter

background.js
async function handleGetCurrentTabId(message, sendResponse) {  try {    const { option, domain, name } = message.payload;    if (option == 1 && name == "block") {      chrome.storage.sync.get([name], async (result) => {        let data = result[name] || {};        if (data.hasOwnProperty(domain)) {          data[domain]++;        } else {          data[domain] = 1;          if (Object.keys(data).length > 50) {            const sortedDomains = Object.keys(data).sort(              (a, b) => data[a] - data[b]            );            for (let i = 0; i < 10; i++) {              delete data[sortedDomains[i]];            }          }        }        await setStorage(chrome.storage.sync, { [name]: data });
When this fires

Every 1 day

An alarm created at install fires the same upload once a day. The server's reply also sets ucycle, the interval the extension waits before checking in again, so the cadence is set remotely.

Where the data goes
    • adblock-genius.com

    Receives the extension's full stored state, including the per-domain visit counters, and returns the blocking rules plus the interval at which the extension checks back in.

Ad Block Genius records the sites you had open when you installed it

At install the extension takes the domain of every tab you have open and saves the list.

We observed that list uploaded to adblock-genius.com alongside a server-assigned user ID on each check-in.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-200
Source
Dynamic sandbox
What actually happens
You did this

You install the extension with your usual tabs still open.

Nothing in the install flow asks about the other tabs.

The extension did this

The install handler reads the hostname of every open tab and saves the de-duplicated list for later upload.

The list is not shown anywhere in the extension's own interface.

The code that does this

The install handler and the tab enumeration

Readable version

chrome.runtime.onInstalled listener

background.js
chrome.runtime.onInstalled.addListener(async (details) => {  if (details.reason === "install") {    // 1. Create an alarm for a daily update    chrome.alarms.create("dailyReset", { periodInMinutes: 60 * 24 });    // 2. Store all opened tab to understand how the user found the extension    processOnInstallTabs();    // closeChromeWebStoreDetailTabs();

processOnInstallTabs()

background.js
function processOnInstallTabs() {  chrome.tabs.query({}, function (tabs) {    const uniqueDomains = new Set();    const collectedUTM = {};    tabs.forEach(function (tab) {      if (!tab.url) return;      // Get the hostname (or subdomain) without the 'www.' prefix.      const domain = extractDomain(tab.url);      if (domain) uniqueDomains.add(domain);      // Check if it's a Chrome Web Store URL with UTM-like parameters.      if (        (tab.url.includes("chromewebstore.google.com") ||          tab.url.includes("microsoftedge.microsoft.com")) &&        tab.url.includes("an")      ) {        try {          const urlObj = new URL(tab.url);          const paramsObj = Object.fromEntries(urlObj.searchParams.entries());          Object.assign(collectedUTM, paramsObj);        } catch (error) {          // Optional: Log error if needed.          // console.error("Error processing UTM parameters:", error);        }      }    });    // Save the unique domains.    chrome.storage.sync.set({ onInstallTabDomains: Array.from(uniqueDomains) });    // Save any collected UTM parameters.    if (Object.keys(collectedUTM).length > 0) {      chrome.storage.sync.set(collectedUTM);    }
What's stored on your device

The sites you had open at install, kept in storage and attached to every later upload.

Location
chrome.storage.sync, key 'onInstallTabDomains'
Contents
[  "myaccount.google.com",  "extensions",  "facebook.com"]
Captured request
POSThttps://adblock-genius.com/adbgenius-v1_6.php

HTTP 200, application/json. The returned keys are written back into extension storage.

Headers
Content-Type
application/json
Body
{  "block": {    "example.com": 1  },  "extid": "dkagmnnkfinalebballociekdnlaniem",  "extv": "1.7.2",  "onInstallTabDomains": [    "newtab"  ],  "ucycle": 0,  "uinfo": "<redacted>",  "whitelistedSites": [],  "foreverBlockedSites": []}
Where the list goes
    • adblock-genius.com

    Receives the extension's full stored state, including the per-domain visit counters, and returns the blocking rules plus the interval at which the extension checks back in.

What it can do

Permissions this extension asks for, as declared in version 1.7.2. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Schedule its own background tasks

    alarms

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

declarativeNetRequestWithHostAccess
Updated 30 September 2026dkagmnnkfinalebballociekdnlaniem