Is Ad Blocker for Chrome safe?

Medium risk

Ad Blocker for Chrome reads Google Search ads and your search query and sends them to newbackend.ads-collect.com.

On Google Search pages the extension collects the ad details shown (ad name, display and redirect URLs, title, description, favicon, call-to-action links) along with the search query taken from the page title. The background worker then posts this data to newbackend.ads-collect.com, with no consent prompt and no connection to its ad blocking function, which uses declarative rulesets.

Strong link to a flagged operator: 1 of the 1 other listing from the same operator is rated high or critical for malicious behaviour. Flagged: Web AdBlocker (high).

webadblockerpluginv1.0Chrome Web Store
49Risk
Who publishes it

webadblockerplugin - 1 other listing from the same operator, 1 of them carrying a finding

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
webadblockerplugin

Same store account

1 other listing published from this account, 10k+ users between them. 1 of them carries a finding.

Web AdBlocker10k+High

Shared hosts - 1 hostname

Hostnames hardcoded in this extension that few other listings call. That can mean one operator behind both, and it can equally mean a small shared vendor, so it is context rather than a conclusion. Hosts that many listings call are left out: they are services, not connections.

newbackend.ads-collect.com
Also called by 2 other listings: Ad Blocker, Ad collector

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ad Blocker for Chrome sends Google ads and your search query to ads-collect.com

Code analysis shows the extension reads the ads on Google search result pages, plus the search query from the page title, and POSTs them to newbackend.ads-collect.com.

No consent prompt appears in the extension.

Severity
High unwanted
Type
Unexpected
CWE
CWE-200
Source
Static analysis
What actually happens
You did this

You run a search on a Google domain such as google.co.kr.

The page loads with sponsored results.

The extension did this

The extension reads each ad and your search query, then sends them to ads-collect.com.

Fields read from each Google ad and sent in adData
  • Search query
    cheap flights london

    The text of your search, taken from the page title.

  • Ad display URL
    www.example-travel.com

    The advertiser address shown in the ad.

  • Ad redirect URL
    https://www.googleadservices.com/pagead/aclk?sa=L&ai=C0abc

    The ad link, which may include tracking parameters.

  • Ad title and text
    Flights from 29 GBP

    The headline and description of the ad.

  • Ad position
    1

    Where the ad sits on the results page.

The code that does this

Content script collection and background POST

Readable version

Content script

content/googleads.js
const searchQuery = document.title.split("-")[0].trim();const topAdsContainer = document.querySelector(".qGXjvb");const bottomAdsContainer = document.querySelector("#bottomads");// per ad (.uEierd): position, searchText, adName, appearanceUrl,// redirectUrl, title, description, favIcon, metaData (CTA links)sendMessageToBackground('post-googleSearch-ads', topAdsData);

Background worker

background/background.js
const DOMAIN = "https://newbackend.ads-collect.com"// ...} else if (request.message === "post-googleSearch-ads") {  const { ads } = request  if (ads.length > 0) {    const endpoint = `${DOMAIN}/api/googleSearch/ad-blocker`    const settings = buildSettings( ads)    await postFetch(endpoint, settings)  }}const buildSettings = ( ads) => {  const data = { adData: ads }  return { method: 'POST', body: JSON.stringify(data),    headers: { 'Content-Type': 'application/json' } }}
Where the data goes
    • newbackend.ads-collect.com

    Receives POST /api/googleSearch/ad-blocker with the search query and ad content.

Observation

Static analysis finding. This behaviour was identified by reading the shipped extension code and has not yet been reproduced in a live run. The trigger conditions and the exact data sent are read from the code, not from an observed capture.

Where it sends data

Destinations our analysis observed Ad Blocker for Chrome contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • newbackend.ads-collect.com

    Ad Blocker for Chrome sends data to newbackend.ads-collect.com. No other extension we have analysed sends data here.

Updated 15 October 2026bhddbhdmfpfdafdnoikmpplooodianhd