Is Adblock for Browser safe?

High risk

Adblock for Browser sends each completed tab URL with a persistent user ID to abforbrowser.com.

When a tab finishes loading, the extension posts the current tab URL and a stored user ID to https://abforbrowser.com/rules. The same response path can also tell the extension to fetch and apply remote declarativeNetRequest rules that may affect browsing across sites.

adblockforbrowserv1.2.3Chrome Web Store
74Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Adblock for Browser sends every visited URL and a persistent ID to its server

On every completed page load, the service worker sends the full page URL and a persistent installation ID to abforbrowser.com/rules, with credentials included, across all websites.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website and the page finishes loading.

This fires for every tab, on every site, because the extension has permission for all URLs.

The extension did this

The extension sends that page's URL and your persistent installation ID to its own server.

The request is sent with credentials included, as if it were an ordinary logged-in request to the extension's own site.

Captured request
POSThttps://abforbrowser.com/rules

JSON object containing ad-blocking rule sets; the extension only continues if the response includes a 'dynamicRules' key.

Headers
Content-Type
application/json
Body
{  "uri": "https://www.bing.com/search?q=buy+usb+cable",  "uid": "5bc36cab-9081-4daf-9395-dbe7faaa09f4"}
What each request to abforbrowser.com/rules contains
  • The page you visited
    https://www.bing.com/search?q=buy+usb+cable

    The exact address of the page you were on, including any search terms in the URL.

  • Your installation ID
    5bc36cab-9081-4daf-9395-dbe7faaa09f4

    A random ID created once at install and reused in every request, so all your visits can be linked together over time.

The code that does this

The navigation listener that builds and sends the request

Readable version

Renamed for readability, same logic

chrome.tabs.onUpdated.addListener(async (tabId, changeInfo, tab) => {  const { status } = changeInfo;  const { url } = tab;  if (status === "complete") {    const payload = { uri: url, uid: await getFromStorage("userId") };    const response = await getSelectorsByHost(`${DOMAIN}/rules`, payload);    if (!response) return;    for (const key in response) {      if (key === "dynamicRules") {        const applyRules = response.applyRules;        updateDynamicRules(response[key], applyRules);      }    }  }});
Where the data goes
    • abforbrowser.com

    Receives the visited page URL and the persistent installation ID from every completed page load, presented in the code as an ad-blocking rules lookup.

What it can do

Permissions this extension asks for, as declared in version 1.2.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • See which of your requests its blocking rules matched

    declarativeNetRequestFeedback

  • Store data in your browser

    storage

  • See the address and title of every tab you have open

    tabs

Where it sends data

Destinations our analysis observed Adblock for Browser contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • abforbrowser.com

    Adblock for Browser sends data to abforbrowser.com. No other extension we have analysed sends data here.

Updated 30 September 2026jcbjcocinigpbgfpnhlpagidbmlngnnn