Is Adblock Bear safe?

Question

Accepted Answer

Adblock Bear is critical risk. Our dynamic analysis observed the extension's content script injecting JavaScript into every website you visit. The injected code is built from rules downloaded from privacy-bear.net, which can include property overrides and timer manipulation targeting any window object. CSP violations attributable to the extension were captured on three separate domains, confirming the script element was appended to document.head during real browsing sessions. There is no integrity check or domain whitelist on the rule payloads — the server can deliver any JavaScript expression. Our dynamic analysis captured the extension adding a priority-99999 declarativeNetRequest allow rule the moment you navigated to a domain on the server-supplied unblock_on_click list. The rule covered all resource types (main_frame, sub_frame, script, image, xmlhttprequest, ping) for your tab, bypassing every blocking ruleset the extension manages, then removed itself after ten seconds. The server populates the unblock_on_click list via the same API endpoint used for rule sync. Substring matching rather than exact hostname matching broadens which URLs trigger the bypass beyond what any domain label implies.

Is Adblock Bear - stop invasive ads safe?

Findings