Is Adblock Bear - stop invasive ads safe?
Blocks ads, pop-ups, video interruptions, and trackers while updating filtering rules from cloud servers.
This extension removes ads and trackers on websites, including pop-ups, video interruptions, analytics, and major social trackers. It also bypasses some anti-adblock walls and syncs daily filtering lists. The description says it syncs a limited list of frequently visited top-level domains to configure active ad-blocking rules.
Who publishes itFondation Suisse pour la Protection de la vie privée - no other listings under this identity
Fondation Suisse pour la Protection de la vie privée - no other listings under this identity
What this publisher told the store about itself, and the other listings that told it the same thing.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote server delivers arbitrary JavaScript executed on every webpage
Our dynamic analysis observed the content script injecting JavaScript into every site, built from rules from privacy-bear.net, capable of property overrides and timer manipulation.
CSP violations were captured on three domains.
- Severity
- Critical unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You navigate to any website.
The content script runs at document_start on every frame across all URLs, as declared in the manifest content_scripts entry.
The extension executes JavaScript code supplied by the server in the page's main world.
content.js reads scriptlet_rules from chrome.storage.local, assembles a JS string from those rules, and injects it via a <script> element appended to document.head, giving it full access to the page's window object.
Returns JSON including remote_scriptlets key with array of URLs (e.g. ["https://privacy-bear.net/ubo_scriptlets.json"]). Service worker fetches each URL and writes parsed rules to chrome.storage.local under scriptlet_rules.
- Content-Type
- application/json
{ "extid": "eopbpljdabbgdphiielllkcpdchpfknf", "version": "2026591500", "syncuid": "a4f2b8c1-9d3e-4f7a-b2e6-1a3c5d7e9f0b", "block": { "example.com": 12, "wikipedia.org": 4 }}Holds server rules. 'global' rules run on every page; domain-keyed rules run on matching hosts only. rule.value/rule.target can be any JS.
- Location
- chrome.storage.local key 'scriptlet_rules'
{ "global": [ { "value": "false", "action": "set-constant", "target": "adblockDetected" }, { "action": "abort-on-property-read", "target": "adblock" } ], "biologianet.com": [ { "value": "true", "action": "set-constant", "target": "canRunAds" } ]}Scriptlet injection in content.js (lines 24-87)
// content.js:24-87try { const domain = window.location.hostname.replace('www.', ''); chrome.storage.local.get(['scriptlet_rules'], (data) => { const rules = data.scriptlet_rules || {}; let activeRules = []; if (rules['global'] && Array.isArray(rules['global'])) activeRules = activeRules.concat(rules['global']); if (rules[domain] && Array.isArray(rules[domain])) activeRules = activeRules.concat(rules[domain]); if (activeRules.length > 0) { let scriptContent = `// PrivacyBear Scriptlets\n`; activeRules.forEach(rule => { if (rule.action === 'set-constant') { scriptContent += ` try { Object.defineProperty(window, '${rule.target}', { value: ${rule.value}, writable: false, configurable: false }); } catch(e) {}`; } else if (rule.action === 'abort-on-property-read') { scriptContent += ` try { Object.defineProperty(window, '${rule.target}', { get: function() { throw new Error('PrivacyBear Abort'); }, set: function(v) { _val = v; } }); } catch(e) {}`; } else if (rule.action === 'setTimeout-defuser') { scriptContent += ` try { const _originalSetTimeout = window.setTimeout; window.setTimeout = function(func, delay, ...args) { if (delay === parseInt('${rule.target}')) { return _originalSetTimeout(func, 1, ...args); } return _originalSetTimeout(func, delay, ...args); }; } catch(e) {}`; } }); // Bypass CSP via Trusted Types policy if (window.trustedTypes && window.trustedTypes.createPolicy) { if (!window.pbPolicy) { try { window.pbPolicy = window.trustedTypes.createPolicy("pbPolicy", { createScript: s => s }); } catch (e) {} } if (window.pbPolicy) scriptContent = window.pbPolicy.createScript(scriptContent); } const scriptEl = document.createElement('script'); scriptEl.textContent = scriptContent; (document.head || document.documentElement).appendChild(scriptEl); scriptEl.remove(); // Clean up traces } });} catch (e) {}- privacy-bear.net
Receives full chrome.storage state (extension ID, version, sync UID, blocked domain counts) and returns scriptlet rule URLs used to populate the JS injection payload
Browsing domains and visit counts sent to privacy-bear.net
The extension tracks every domain visited in local storage, uploading the map to privacy-bear.net with a server ID.
One POST held the map with install ID; a follow-up ~2.5s later added an 88-char syncuid, resent every sync.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You navigate to a top-level page such as amazon.com or bing.com.
The extension's ad-blocking rules apply to the page, and the navigation is also recorded for the domain-visit counter.
The extension increments a per-domain visit counter, then on its next scheduled sync sends the accumulated domain map plus a persistent install ID to privacy-bear.net.
We captured two such POST requests in one session; the second carried a server-assigned syncuid alongside the same domain-visit map.
Server replied 200 OK with a JSON object that assigned a new persistent syncuid value along with sync-scheduling and ad-block-rule data. The extension stored the syncuid and included it in the next sync call from the same installation.
- Content-Type
- application/json
{ "block": { "amazon.co.uk": 1, "amazon.com": 2, "bing.com": 1, "example.com": 1 }, "lastUpdated": 0, "extid": "fkdekmdnongdplbmldfhhfbmeoanakkl", "version": "20265915"}- Visited domain names + visit counts{"amazon.com":2,"bing.com":1,"example.com":1}
Shows every top-level domain you've visited since install, and how many times.
- Persistent installation ID (syncuid)8lBrsxWyV7ZknT4ruDr6N0J3xf33QzZMHK0j/aIHJleJ6QxUvIz/+fJ5/eyiG+MzyzUyEbqYA7RBw4Xbhz2XGkb73JpWHHm6IxO8dqP7Esw2hhtdTQ==
A server-assigned token stored locally and resent on every sync, letting the server tie your domain-visit reports to one install over time.
- Extension install ID and versionextid=fkdekmdnongdplbmldfhhfbmeoanakkl, version=20265915
Identifies which extension build sent the report.
- Last sync timestamplastUpdated=1788365192997
Records when the install last reported in, used to schedule the next sync.
Each key is a visited domain; 'c' is visit count, 't' the last-visit time. This local record is what's uploaded on every sync.
- Location
- chrome.storage.sync key 'block'
{ "bing.com": { "c": 1, "t": 1788365190000 }, "amazon.com": { "c": 2, "t": 1788365190000 }, "example.com": { "c": 1, "t": 1788365190000 }}- privacy-bear.net
Receives the domain-visit map and persistent syncuid from every installation on each sync call; also the endpoint that supplies ad-block rules and CSS rules back to the extension.
Server response can replace the entire ad-block ruleset
The background script sends telemetry to privacy-bear.net and gets JSON back that can hold a 'rules' key.
When present, the extension deletes every DNR rule and installs the response's rules unchecked.
Session: 11 rules, ~107,000 domains.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
The extension periodically reports installation telemetry to privacy-bear.net and asks for updated rules.
This happens on install and again on a scheduled interval, with no user interaction.
The server's response can include a 'rules' key; when it does, the extension deletes every current network-blocking rule and installs whatever the response contains.
We captured a response of this kind holding 11 rules covering roughly 107,000 domains, applied with no signature check or user confirmation.
The server replied 200 OK with a ~119KB JSON body whose 'rules' key held a JSON-encoded array of 11 DeclarativeNetRequest rules together covering roughly 107,000 requestDomains, each set to redirect matching requests to the extension's own close.html page. The same response included a 'remote_dnr_rules' key pointing to an externally-hosted rule file, which the extension separately fetches and merges into the same ruleset.
- Content-Type
- application/json
{ "block": { "amazon.co.uk": 1, "amazon.com": 2, "bing.com": 1, "example.com": 1 }, "lastUpdated": 0, "extid": "fkdekmdnongdplbmldfhhfbmeoanakkl", "version": "20265915"}- Domains matched by each rule0019x.com, 1kx.gleetchisurvey.top, 1xlite-208883.top, … (~107,000 requestDomains across the 11 observed rules)
The server lists domains, and the extension blocks or redirects matching requests to those domains on your device.
- Redirect targetchrome-extension://fkdekmdnongdplbmldfhhfbmeoanakkl/close.html#<original-url>
Matched requests redirect to a URL the rule specifies, here the extension's block page, but the format allows any target.
- Externally-hosted rule fileremote_dnr_rules: ["https://raw.githubusercontent.com/meganerasam/blocklist-v3/refs/heads/master/all-in-one/merged-dnr/dnr.json"]
The response can also point to a separate rule file hosted elsewhere, downloaded and merged the same way.
- privacy-bear.net
Sole source of the 'rules' payload that fully replaces the extension's DeclarativeNetRequest ruleset on every sync.
- raw.githubusercontent.com
Externally-hosted rule file referenced by privacy-bear.net's response and merged into the same ruleset with no additional review step.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 2025.06.14.15. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Block and redirect the requests your browser makes
declarativeNetRequest
Store an unlimited amount of data in your browser
unlimitedStorage
See every page you navigate to, as you navigate to it
webNavigation
Where it sends data
Destinations our analysis observed Adblock Bear contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- Ad Block Bear cloud servers
Adblock Bear sends data to Ad Block Bear cloud servers. Named as a recipient in this extension's own analysis.