Is Cool Ad Popup Blocker safe?
Blocks popups and intrusive ads to reduce distractions while browsing.
This extension blocks annoying popups, intrusive banners, ads, and trackers hidden in ads according to its store description. It runs in the background, requires no setup, and lets users turn the blocker off for chosen websites from the extension icon.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server can push arbitrary redirect rules to all installations
Cool Ad Popup Blocker fetches a rule update from cooladblocker.com daily, on startup, and at install.
The response can hold declarativeNetRequest rules, incl. redirects that rewrite URLs.
Each install gets a unique ID for per-user rules.
On install, Chrome startup, or hourly alarm, the extension contacts cooladblocker.com/protect/update/ with your installation's unique ID.
The request carries a 'kan' query parameter unique to each installation, allowing the server to return different rule payloads to different users.
The extension replaces all dynamic network-filtering rules with whatever the server returns, without validating rule types.
declarativeNetRequest dynamic rules support 'redirect' actions, meaning the server can instruct the browser to rewrite any URL before it loads.
Update handler and rule application, backgroundProtection.js
// _updateHandler checks a 24-hour gate, then fetches: // baseUrl = 'https://cooladblocker.com' // uName = 'kan' // updateUrl = 'https://cooladblocker.com/protect/update/?kan=<extensionInstance>' // // If the server's 'currentVersion' differs from the locally stored one, // it fetches updateData.url (also server-controlled) and passes the // 'dynamicRules' array directly to updateDynamicRules(). // // DNR dynamic rules may include action type 'redirect', which causes the // browser to rewrite matching URLs before they load — there is no // server-side or client-side constraint on which action types are accepted. // // The 'extensionInstance' / 'kan' value is assigned at install from // cooladblocker.com/ini/ and persists in chrome.storage.local, enabling // per-installation targeting.
Runs _updateHandler on Chrome startup (autoStartCheck IIFE) and at install, in addition to the hourly alarm. The 24-hour nextUpdate gate limits full rule replacement to once per day per installation.
- cooladblocker.com
Operator-controlled host. Provides the install ID at /ini/, an update manifest at /protect/update/, and the rule bundle at the returned URL. Also the uninstall tracking endpoint.
Lists the current declarativeNetRequest dynamic rules applied by the extension, so you can inspect whether any redirect-type rules are active.
#!/usr/bin/env bash
# Requires Chrome with remote debugging enabled.
# Usage: bash check-dynamic-rules.sh
#
# 1. Launch Chrome with: --remote-debugging-port=9222
# 2. Run this script.
EXT_ID="gdfeccaioepgmgjcecjpiabelmbbpijf"
curl -s http://localhost:9222/json | \
python3 -c "
import json, sys, urllib.request
targets = json.load(sys.stdin)
bg = next((t for t in targets if 'service_worker' in t.get('type','') and '$EXT_ID' in t.get('url','')), None)
if not bg:
print('Background service worker not found — is the extension loaded?')
sys.exit(1)
print('Found SW target:', bg['id'])
# Use CDP Runtime.evaluate to dump dynamic rules
print('Attach DevTools to ws://localhost:9222', bg['webSocketDebuggerUrl'])
print('Then run: chrome.declarativeNetRequest.getDynamicRules(rules => console.log(JSON.stringify(rules, null, 2)))')
"- 1Launch Chrome with --remote-debugging-port=
- 29
- 32
- 42
- 5
- 6bash check-dynamic-rules.sh.
- 7Connect DevTools to the printed WebSocket URL and run the getDynamicRules() call to inspect active rules.