Is Adaware AdBlock safe?

Low risk

Adaware AdBlock is low risk. Adaware AdBlock ships a hardcoded list of 85 trusted domains written into its blocking engine on startup, no prompt to change it. Eight belong to the vendor family, including adaware.com. Those domains skip its own blocking rules.

adblockv4.2.1Chrome Web Store
20Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityLOW
ClassUNWANTED
TypeUnexpected
CWECWE-200
SourceAI SANDBOX

Adaware AdBlock Exempts Its Own Vendor Domains From Blocking

Adaware AdBlock ships a hardcoded list of 85 trusted domains written into its blocking engine on startup, no prompt to change it.

Eight belong to the vendor family, including adaware.com.

Those domains skip its own blocking rules.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You start Chrome, or install/update the extension, with Adaware AdBlock present.

No click or setting change is required.

The extension did this

The extension automatically adds adaware.com, avanquest.com, surveymonkey.com, and five other vendor domains to its own ad/tracker-blocking allow list.

This runs on every browser startup, and there is no setting that removes these domains from the trusted list.

02EvidenceCODE COMPARE
The code that does this

The default whitelist, and how it becomes a blocking exemption

What it actually does
Same list, with the vendor-domain block called outjs/adaware-lib/adaware-ready.js
const setWhitelistedSites = () => {
    const netWhitelistDefault = [
        // --- 77 partner/legacy domains (Microsoft, Skype, Yahoo, etc.) ---
        'account.live.com', 'app.uservoice.com', 'aspnet.uservoice.com', 'bing.com',
        'blog.onedrive.com', 'blogs.iis.net', 'blogs.msdn.com', 'blogs.skype.com',
        'channel9.msdn.com', 'community.uservoice.com', 'dev.onedrive.com', 'dev.onenote.com',
        'forums.iis.net', 'go.skype.com', 'google.ca', 'google.com', 'login.iis.net',
        'login.live.com', 'login.microsoftonline.com', 'microsoft.qualtrics.com', 'msn.com',
        'office.live.com', 'onedrive.live.com', 'php.iis.net', 'products.office.com',
        'secure.skype.com', 'signup.live.com', 'sodapdf.com', 'store.digitalriver.com',
        'store.office.com', 'support.office.com', 'support.skype.com', 'templates.office.com',
        'visualstudio.uservoice.com', 'webcompanion.com', 'aabacosmallbusiness.com', 'asp.net',
        'digitalriver.com', 'flickr.com', 'iis.net', 'imgopt.com', 'live.com', 'match.com',
        'microsoftonline.com', 'microsoftstore.com', 'neudesicmediagroup.com', 'office.com',
        'onenote.com', 'outlook.com', 'qualtrics.com', 'skype.com', 'tumblr.com', 'uservoice.com',
        'windows.com', 'windowsphone.com', 'yimg.com', 'ysearchblog.com', 'yahoo.com',
        'yahootravel.tumblr.com', 'googleadservices.com', 'chip.de', 'paltalkconnect.com',
        'paltalk.com', 'camfrog.com', 'tinychat.com', 'client.paltalk.com', 'advertising.paltalk.com',
        'findmysoft.com', 'yahooadvertisingca.tumblr.com', 'classifieds.canoe.com', 'monster.ca',
        'yahoo.yellowpages.ca', 'mail.yahoo.ca', 'yahoo.tumblr.com', 'windowsazure.com',
        'microsoft.com', 'yahoogroups.com',

        // --- Adaware / Avanquest family domains: the extension's OWN
        //     vendor infrastructure, exempted from the same blocking
        //     engine it enforces on every other site ---
        'jtracking.lulusoft.com',  // Lulusoft tracking subdomain
        'adaware.com',             // Adaware's own site
        'surveymonkey.com',        // in-product survey vendor
        'store.adaware.com',       // Adaware storefront
        'pchelpsoft.com',          // Avanquest-family brand
        'inpixio.com',             // Avanquest-family brand
        'store.pchelpsoft.com',    // PCHelpSoft storefront
        'avanquest.com',           // Adaware's parent company
    ];

    getTrustedSites().then(l => {
        const list = Array.from(l);
        if (list.length > 0) {
            // Whatever the user has trusted is MERGED IN, but the 85
            // defaults above are always present regardless.
            setTrustedSites(netWhitelistDefault.concat(list));
        } else {
            setTrustedSites(netWhitelistDefault);
        }
    });
}
The trusted-sites list becomes a network-level allow rulejs/mode-manager.js
async function filteringModesToDNR(modes) {
    const dynamicRuleMap = await getDynamicRules();
    // modes.none is the trusted-sites set built above -- it always
    // contains the 8 vendor domains, regardless of user choice.
    const noneHostnames = [ ...modes.none ];
    const notNoneHostnames = [ ...modes.basic, ...modes.optimal, ...modes.complete ];

    if ( noneHostnames.length !== 0 ) {
        // Rule 0: exempt whole PAGE LOADS from these domains.
        const rule0 = {
            id: TRUSTED_DIRECTIVE_BASE_RULE_ID + 0,
            action: { type: 'allowAllRequests' },
            condition: { resourceTypes: [ 'main_frame' ] },
            priority: 100,
        };
        rule0.condition.requestDomains = noneHostnames.slice(); // includes adaware.com etc.

        // Rule 1: exempt SCRIPTS served FROM these domains -- this is the
        // rule that lets tracking/analytics scripts hosted on adaware.com,
        // avanquest.com, surveymonkey.com etc. run unblocked on any page.
        const rule1 = {
            id: TRUSTED_DIRECTIVE_BASE_RULE_ID + 1,
            action: { type: 'allow' },
            condition: { resourceTypes: [ 'script' ] },
            priority: 100,
        };
        rule1.condition.initiatorDomains = noneHostnames.slice(); // includes adaware.com etc.

        await dnr.updateDynamicRules({
            addRules: [ rule0, rule1 ],
        });
    }
}
03EvidenceTEMPORAL PATTERN
When this fires
On every browser startup

The default whitelist -- including the extension's own vendor domains -- is reapplied every time the browser starts, and again as soon as the extension's own initialization data finishes loading after install or update. There is no user-facing setting that removes these domains from the trusted list.

04EvidenceTHIRD PARTY LIST
Domains exempted from ad/tracker blocking by the hardcoded whitelist
  • adaware.com

    Adaware's own marketing site -- part of the extension developer's own vendor family.

  • store.adaware.com

    Adaware's e-commerce storefront -- same vendor family as adaware.com.

  • avanquest.com

    Avanquest, the corporate parent of Adaware, Lulusoft, PCHelpSoft, and InPixio.

  • surveymonkey.com

    Third-party survey platform used for in-product feedback/survey flows.

  • jtracking.lulusoft.com

    Lulusoft tracking subdomain -- Lulusoft is part of the same Avanquest corporate family as Adaware.

  • pchelpsoft.com

    PCHelpSoft, another Avanquest-family software brand.

  • store.pchelpsoft.com

    PCHelpSoft's storefront -- same vendor family as pchelpsoft.com.

  • inpixio.com

    InPixio, another Avanquest-family software brand.

05EvidenceARTIFACT
Check if you're affected

Extracts the hardcoded default whitelist from the extension's own source files and checks whether it contains the extension vendor's own domains, whether it's applied automatically on startup, and whether it's enforced through a declarativeNetRequest allow rule.

RequiresNode.js 18+
adaware-whitelist-detector.js · js
#!/usr/bin/env node
// Detector: checks whether an Adaware AdBlock install ships the
// extension's own vendor domains in its hardcoded declarativeNetRequest
// allow-list.
//
// Usage:
//   1. Unpack the extension's .crx into a folder (e.g. rename to .zip
//      and extract, or use any CRX-to-folder tool).
//   2. node adaware-whitelist-detector.js <path-to-unpacked-extension>

const fs = require('fs');
const path = require('path');

const extDir = process.argv[2];
if (!extDir) {
  console.error('Usage: node adaware-whitelist-detector.js <path-to-unpacked-extension>');
  process.exit(1);
}

const readySrc = fs.readFileSync(path.join(extDir, 'js/adaware-lib/adaware-ready.js'), 'utf8');
const modeSrc = fs.readFileSync(path.join(extDir, 'js/mode-manager.js'), 'utf8');

const arrMatch = readySrc.match(/const netWhitelistDefault = \[([\s\S]*?)\];/);
if (!arrMatch) {
  console.log('netWhitelistDefault array not found -- extension code may have changed since this was written.');
  process.exit(1);
}
const domains = arrMatch[1].split(',').map(s => s.trim().replace(/^'|'$/g, '')).filter(Boolean);

const vendorDomains = [
  'adaware.com', 'store.adaware.com', 'avanquest.com', 'surveymonkey.com',
  'jtracking.lulusoft.com', 'pchelpsoft.com', 'store.pchelpsoft.com', 'inpixio.com',
];

console.log(`Hardcoded default whitelist contains ${domains.length} domains.`);
console.log('Vendor/self domains present in that hardcoded list:');
for (const d of vendorDomains) {
  console.log(`  [${domains.includes(d) ? 'x' : ' '}] ${d}`);
}

const unconditionalCall = /const onFirstFetchReady = \(fetched\) => \{[\s\S]*?setWhitelistedSites\(\);/.test(readySrc);
const startupBranchCall = /reason === "startup"[\s\S]*?setWhitelistedSites\(\);/.test(readySrc);
console.log(`\nsetWhitelistedSites() called unconditionally on init: ${unconditionalCall}`);
console.log(`setWhitelistedSites() called on browser startup: ${startupBranchCall}`);

const dnrAllowAllRequests = /action:\s*\{\s*type:\s*'allowAllRequests'\s*\}/.test(modeSrc);
const dnrAllowScript = /action:\s*\{\s*type:\s*'allow'\s*\}[\s\S]{0,200}resourceTypes:\s*\[\s*'script'\s*\]/.test(modeSrc);
const usesDNR = /dnr\.updateDynamicRules\(updateOptions\)/.test(modeSrc);
console.log(`\nWrites a declarativeNetRequest 'allowAllRequests' rule: ${dnrAllowAllRequests}`);
console.log(`Writes a declarativeNetRequest 'allow' rule for scripts: ${dnrAllowScript}`);
console.log(`Applied via chrome.declarativeNetRequest.updateDynamicRules(): ${usesDNR}`);

const allPresent = vendorDomains.every(d => domains.includes(d));
if (allPresent && (unconditionalCall || startupBranchCall) && dnrAllowAllRequests && dnrAllowScript && usesDNR) {
  console.log("\nRESULT: this install whitelists the extension's own vendor domains from ad/tracker blocking, automatically, with no user action.");
} else {
  console.log('\nRESULT: one or more indicators did not match -- this install may differ from the version this detector was written against.');
}
How to run it
  1. 1
    Unpack the Adaware AdBlock .crx or an install folder.
  2. 2
    Run: node adaware-whitelist-detector.js <path>.
  3. 3
    Read the checklist; all 8 vendor domains plus both declarativeNetRequest rules confirmed means the exemption is active.
Updated 17 September 2026cmllgdnjnkbapbchnebiedipojhmnjej