Is Cool Ad Popup Blocker safe?

Medium risk

Blocks popups and intrusive ads to reduce distractions while browsing.

This extension blocks annoying popups, intrusive banners, ads, and trackers hidden in ads according to its store description. It runs in the background, requires no setup, and lets users turn the blocker off for chosen websites from the extension icon.

CoolBlock Studiosv2.0.0.26Chrome Web Store
47Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Server can push arbitrary redirect rules to all installations

Cool Ad Popup Blocker fetches a rule update from cooladblocker.com daily, on startup, and at install.

The response can hold declarativeNetRequest rules, incl. redirects that rewrite URLs.

Each install gets a unique ID for per-user rules.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

On install, Chrome startup, or hourly alarm, the extension contacts cooladblocker.com/protect/update/ with your installation's unique ID.

The request carries a 'kan' query parameter unique to each installation, allowing the server to return different rule payloads to different users.

The extension did this

The extension replaces all dynamic network-filtering rules with whatever the server returns, without validating rule types.

declarativeNetRequest dynamic rules support 'redirect' actions, meaning the server can instruct the browser to rewrite any URL before it loads.

The code that does this

Update handler and rule application, backgroundProtection.js

Readable version
// _updateHandler checks a 24-hour gate, then fetches://   baseUrl = 'https://cooladblocker.com'//   uName   = 'kan'//   updateUrl = 'https://cooladblocker.com/protect/update/?kan=<extensionInstance>'//// If the server's 'currentVersion' differs from the locally stored one,// it fetches updateData.url (also server-controlled) and passes the// 'dynamicRules' array directly to updateDynamicRules().//// DNR dynamic rules may include action type 'redirect', which causes the// browser to rewrite matching URLs before they load — there is no// server-side or client-side constraint on which action types are accepted.//// The 'extensionInstance' / 'kan' value is assigned at install from// cooladblocker.com/ini/ and persists in chrome.storage.local, enabling// per-installation targeting.
When this fires

On every browser startup

Runs _updateHandler on Chrome startup (autoStartCheck IIFE) and at install, in addition to the hourly alarm. The 24-hour nextUpdate gate limits full rule replacement to once per day per installation.

Endpoints contacted during rule updates
    • cooladblocker.com

    Operator-controlled host. Provides the install ID at /ini/, an update manifest at /protect/update/, and the rule bundle at the returned URL. Also the uninstall tracking endpoint.

Check if you're affected

Lists the current declarativeNetRequest dynamic rules applied by the extension, so you can inspect whether any redirect-type rules are active.

Requires
  • bash
  • curl
  • python3
check-dynamic-rules.sh · sh
#!/usr/bin/env bash# Requires Chrome with remote debugging enabled.# Usage: bash check-dynamic-rules.sh## 1. Launch Chrome with: --remote-debugging-port=9222# 2. Run this script.EXT_ID="gdfeccaioepgmgjcecjpiabelmbbpijf"curl -s http://localhost:9222/json | \  python3 -c "import json, sys, urllib.requesttargets = json.load(sys.stdin)bg = next((t for t in targets if 'service_worker' in t.get('type','') and '$EXT_ID' in t.get('url','')), None)if not bg:    print('Background service worker not found — is the extension loaded?')    sys.exit(1)print('Found SW target:', bg['id'])# Use CDP Runtime.evaluate to dump dynamic rulesprint('Attach DevTools to ws://localhost:9222', bg['webSocketDebuggerUrl'])print('Then run: chrome.declarativeNetRequest.getDynamicRules(rules => console.log(JSON.stringify(rules, null, 2)))')"
How to run it
  1. 1Launch Chrome with --remote-debugging-port=
  2. 29
  3. 32
  4. 42
  5. 5
  6. 6bash check-dynamic-rules.sh.
  7. 7Connect DevTools to the printed WebSocket URL and run the getDynamicRules() call to inspect active rules.

What it can do

Permissions this extension asks for, as declared in version 2.0.0.26. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

Updated 30 September 2026gdfeccaioepgmgjcecjpiabelmbbpijf