Is Adaware AdBlock safe?
Adaware AdBlock is low risk. Adaware AdBlock ships a hardcoded list of 85 trusted domains written into its blocking engine on startup, no prompt to change it. Eight belong to the vendor family, including adaware.com. Those domains skip its own blocking rules.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Adaware AdBlock Exempts Its Own Vendor Domains From Blocking
Adaware AdBlock ships a hardcoded list of 85 trusted domains written into its blocking engine on startup, no prompt to change it.
Eight belong to the vendor family, including adaware.com.
Those domains skip its own blocking rules.
You start Chrome, or install/update the extension, with Adaware AdBlock present.
No click or setting change is required.
The extension automatically adds adaware.com, avanquest.com, surveymonkey.com, and five other vendor domains to its own ad/tracker-blocking allow list.
This runs on every browser startup, and there is no setting that removes these domains from the trusted list.
The default whitelist, and how it becomes a blocking exemption
const setWhitelistedSites = () => {
const netWhitelistDefault = [
// --- 77 partner/legacy domains (Microsoft, Skype, Yahoo, etc.) ---
'account.live.com', 'app.uservoice.com', 'aspnet.uservoice.com', 'bing.com',
'blog.onedrive.com', 'blogs.iis.net', 'blogs.msdn.com', 'blogs.skype.com',
'channel9.msdn.com', 'community.uservoice.com', 'dev.onedrive.com', 'dev.onenote.com',
'forums.iis.net', 'go.skype.com', 'google.ca', 'google.com', 'login.iis.net',
'login.live.com', 'login.microsoftonline.com', 'microsoft.qualtrics.com', 'msn.com',
'office.live.com', 'onedrive.live.com', 'php.iis.net', 'products.office.com',
'secure.skype.com', 'signup.live.com', 'sodapdf.com', 'store.digitalriver.com',
'store.office.com', 'support.office.com', 'support.skype.com', 'templates.office.com',
'visualstudio.uservoice.com', 'webcompanion.com', 'aabacosmallbusiness.com', 'asp.net',
'digitalriver.com', 'flickr.com', 'iis.net', 'imgopt.com', 'live.com', 'match.com',
'microsoftonline.com', 'microsoftstore.com', 'neudesicmediagroup.com', 'office.com',
'onenote.com', 'outlook.com', 'qualtrics.com', 'skype.com', 'tumblr.com', 'uservoice.com',
'windows.com', 'windowsphone.com', 'yimg.com', 'ysearchblog.com', 'yahoo.com',
'yahootravel.tumblr.com', 'googleadservices.com', 'chip.de', 'paltalkconnect.com',
'paltalk.com', 'camfrog.com', 'tinychat.com', 'client.paltalk.com', 'advertising.paltalk.com',
'findmysoft.com', 'yahooadvertisingca.tumblr.com', 'classifieds.canoe.com', 'monster.ca',
'yahoo.yellowpages.ca', 'mail.yahoo.ca', 'yahoo.tumblr.com', 'windowsazure.com',
'microsoft.com', 'yahoogroups.com',
// --- Adaware / Avanquest family domains: the extension's OWN
// vendor infrastructure, exempted from the same blocking
// engine it enforces on every other site ---
'jtracking.lulusoft.com', // Lulusoft tracking subdomain
'adaware.com', // Adaware's own site
'surveymonkey.com', // in-product survey vendor
'store.adaware.com', // Adaware storefront
'pchelpsoft.com', // Avanquest-family brand
'inpixio.com', // Avanquest-family brand
'store.pchelpsoft.com', // PCHelpSoft storefront
'avanquest.com', // Adaware's parent company
];
getTrustedSites().then(l => {
const list = Array.from(l);
if (list.length > 0) {
// Whatever the user has trusted is MERGED IN, but the 85
// defaults above are always present regardless.
setTrustedSites(netWhitelistDefault.concat(list));
} else {
setTrustedSites(netWhitelistDefault);
}
});
}async function filteringModesToDNR(modes) {
const dynamicRuleMap = await getDynamicRules();
// modes.none is the trusted-sites set built above -- it always
// contains the 8 vendor domains, regardless of user choice.
const noneHostnames = [ ...modes.none ];
const notNoneHostnames = [ ...modes.basic, ...modes.optimal, ...modes.complete ];
if ( noneHostnames.length !== 0 ) {
// Rule 0: exempt whole PAGE LOADS from these domains.
const rule0 = {
id: TRUSTED_DIRECTIVE_BASE_RULE_ID + 0,
action: { type: 'allowAllRequests' },
condition: { resourceTypes: [ 'main_frame' ] },
priority: 100,
};
rule0.condition.requestDomains = noneHostnames.slice(); // includes adaware.com etc.
// Rule 1: exempt SCRIPTS served FROM these domains -- this is the
// rule that lets tracking/analytics scripts hosted on adaware.com,
// avanquest.com, surveymonkey.com etc. run unblocked on any page.
const rule1 = {
id: TRUSTED_DIRECTIVE_BASE_RULE_ID + 1,
action: { type: 'allow' },
condition: { resourceTypes: [ 'script' ] },
priority: 100,
};
rule1.condition.initiatorDomains = noneHostnames.slice(); // includes adaware.com etc.
await dnr.updateDynamicRules({
addRules: [ rule0, rule1 ],
});
}
}The default whitelist -- including the extension's own vendor domains -- is reapplied every time the browser starts, and again as soon as the extension's own initialization data finishes loading after install or update. There is no user-facing setting that removes these domains from the trusted list.
- adaware.com
Adaware's own marketing site -- part of the extension developer's own vendor family.
- store.adaware.com
Adaware's e-commerce storefront -- same vendor family as adaware.com.
- avanquest.com
Avanquest, the corporate parent of Adaware, Lulusoft, PCHelpSoft, and InPixio.
- surveymonkey.com
Third-party survey platform used for in-product feedback/survey flows.
- jtracking.lulusoft.com
Lulusoft tracking subdomain -- Lulusoft is part of the same Avanquest corporate family as Adaware.
- pchelpsoft.com
PCHelpSoft, another Avanquest-family software brand.
- store.pchelpsoft.com
PCHelpSoft's storefront -- same vendor family as pchelpsoft.com.
- inpixio.com
InPixio, another Avanquest-family software brand.
Extracts the hardcoded default whitelist from the extension's own source files and checks whether it contains the extension vendor's own domains, whether it's applied automatically on startup, and whether it's enforced through a declarativeNetRequest allow rule.
#!/usr/bin/env node
// Detector: checks whether an Adaware AdBlock install ships the
// extension's own vendor domains in its hardcoded declarativeNetRequest
// allow-list.
//
// Usage:
// 1. Unpack the extension's .crx into a folder (e.g. rename to .zip
// and extract, or use any CRX-to-folder tool).
// 2. node adaware-whitelist-detector.js <path-to-unpacked-extension>
const fs = require('fs');
const path = require('path');
const extDir = process.argv[2];
if (!extDir) {
console.error('Usage: node adaware-whitelist-detector.js <path-to-unpacked-extension>');
process.exit(1);
}
const readySrc = fs.readFileSync(path.join(extDir, 'js/adaware-lib/adaware-ready.js'), 'utf8');
const modeSrc = fs.readFileSync(path.join(extDir, 'js/mode-manager.js'), 'utf8');
const arrMatch = readySrc.match(/const netWhitelistDefault = \[([\s\S]*?)\];/);
if (!arrMatch) {
console.log('netWhitelistDefault array not found -- extension code may have changed since this was written.');
process.exit(1);
}
const domains = arrMatch[1].split(',').map(s => s.trim().replace(/^'|'$/g, '')).filter(Boolean);
const vendorDomains = [
'adaware.com', 'store.adaware.com', 'avanquest.com', 'surveymonkey.com',
'jtracking.lulusoft.com', 'pchelpsoft.com', 'store.pchelpsoft.com', 'inpixio.com',
];
console.log(`Hardcoded default whitelist contains ${domains.length} domains.`);
console.log('Vendor/self domains present in that hardcoded list:');
for (const d of vendorDomains) {
console.log(` [${domains.includes(d) ? 'x' : ' '}] ${d}`);
}
const unconditionalCall = /const onFirstFetchReady = \(fetched\) => \{[\s\S]*?setWhitelistedSites\(\);/.test(readySrc);
const startupBranchCall = /reason === "startup"[\s\S]*?setWhitelistedSites\(\);/.test(readySrc);
console.log(`\nsetWhitelistedSites() called unconditionally on init: ${unconditionalCall}`);
console.log(`setWhitelistedSites() called on browser startup: ${startupBranchCall}`);
const dnrAllowAllRequests = /action:\s*\{\s*type:\s*'allowAllRequests'\s*\}/.test(modeSrc);
const dnrAllowScript = /action:\s*\{\s*type:\s*'allow'\s*\}[\s\S]{0,200}resourceTypes:\s*\[\s*'script'\s*\]/.test(modeSrc);
const usesDNR = /dnr\.updateDynamicRules\(updateOptions\)/.test(modeSrc);
console.log(`\nWrites a declarativeNetRequest 'allowAllRequests' rule: ${dnrAllowAllRequests}`);
console.log(`Writes a declarativeNetRequest 'allow' rule for scripts: ${dnrAllowScript}`);
console.log(`Applied via chrome.declarativeNetRequest.updateDynamicRules(): ${usesDNR}`);
const allPresent = vendorDomains.every(d => domains.includes(d));
if (allPresent && (unconditionalCall || startupBranchCall) && dnrAllowAllRequests && dnrAllowScript && usesDNR) {
console.log("\nRESULT: this install whitelists the extension's own vendor domains from ad/tracker blocking, automatically, with no user action.");
} else {
console.log('\nRESULT: one or more indicators did not match -- this install may differ from the version this detector was written against.');
}
- 1Unpack the Adaware AdBlock .crx or an install folder.
- 2Run: node adaware-whitelist-detector.js <path>.
- 3Read the checklist; all 8 vendor domains plus both declarativeNetRequest rules confirmed means the exemption is active.