Is Pie Adblock - A Powerful Free Ad Blocker safe?
Pie Adblock is medium risk. Pie Adblock declares pie.org as externally_connectable, letting its pages message the background directly. One handler disables installed extensions on a hardcoded rival list (uBlock Origin, AdGuard, Ghostery), via 'management', no prompt.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
pie.org can disable your other ad blockers via Pie's external message channel
Pie Adblock declares pie.org as externally_connectable, letting its pages message the background directly.
One handler disables installed extensions on a hardcoded rival list (uBlock Origin, AdGuard, Ghostery), via 'management', no prompt.
You load a page on pie.org with Pie Adblock installed.
pie.org is listed as an externally_connectable origin, so its pages can message the extension directly.
The extension disables every competing ad blocker and privacy tool it finds from a fixed list.
It calls chrome.management.setEnabled(id, false) for each installed extension whose ID appears in the bundled competitor list.
The external handler that disables competing extensions
function management({ configManager, messages: t, externalMessages: n }) {
// ...selects installed competitors from remote config...
async function getOtherEnabledAdblockers() {
const config = await configManager.getConfig();
const ids = config?.additionalAdbs.map(e => e.id) || [];
return (await management.getAll())
.filter(({ id, enabled }) => ids.includes(id) && enabled);
}
// The disable handler
async function disableAdblockers() {
(await getOtherEnabledAdblockers()).forEach(({ id }) => {
chrome.management.setEnabled(id, false);
});
}
return {
start: async function () {
// registered on BOTH internal (t) and external (n) buses:
t.addListener("management:adblockers_disable", disableAdblockers);
n.addListener("management:adblockers_disable", disableAdblockers);
// ...other handlers...
},
// ...
};
}// externalMessages bus (n):
return {
addListener(name, handler) { handlers[name] = handlers[name] || []; handlers[name].push(handler); },
start() {
chrome.runtime.onMessageExternal &&
chrome.runtime.onMessageExternal.addListener(dispatch);
},
};| Field | Value | Why it matters | |
|---|---|---|---|
uBlock Origin | cjpalhdlnbpafiamejdnhcphjbkeiagm | A widely used open-source content blocker; would be turned off if installed and enabled. | |
Adblock Plus | cfhdojbkjhnklbpkdaibdccddilifddb | Popular ad-blocking extension on the disable list. | |
AdGuard | bgnkhhnnamicmpeenaelnjfhikgbkllg | Ad blocker and privacy extension on the disable list. | |
AdGuard MV3 | apjcbfpjihpedihablmalmbbhjpklbdf | The Manifest V3 build of AdGuard, also targeted. | |
uBO Lite (MV3) | ddkjiahejlhfcafbddmgiahcphecmpfh | The Manifest V3 lite build of uBlock Origin, also targeted. | |
Ghostery | mlomiejdfkolichcflejclcbmpeaniij | Privacy and tracker-blocking extension on the disable list. | |
Adblock | gighmmpiobklfepjocnamgkkbiglidom | Ad-blocking extension on the disable list. | |
uBlock | epcnnfbjfcgphgdmggkamkmgojdagdnn | Ad-blocking extension on the disable list. | |
Adblock from Capital One | piabandohnapkgaagcppmkdbfmdgikjh | Capital One-branded ad blocker on the disable list. |
Confirms for yourself that Pie Adblock registers a disable handler reachable from pie.org and which extensions are on its disable list.
# 1. Confirm pie.org is allowed to message the extension
cat manifest.json | python3 -c 'import sys,json; print(json.load(sys.stdin)["externally_connectable"])'
# expect matches: https://pie.org/* , https://www.pie.org/*
# 2. Confirm the disable handler is registered on the external bus
grep -o 'addListener("management:adblockers_disable"[^)]*)' background.js
# two hits: one on internal bus (t), one on external bus (n)
# 3. Confirm the disable mechanism
grep -o 'management.setEnabled([a-z],![0-9])' background.js
# expect: management.setEnabled(e,!1) -> setEnabled(id, false)
# 4. Dump the hardcoded competitor list
grep -o '"additionalAdbs":\[[^]]*]' background.js- 1Unzip the .crx into a folder.
- 2cd into the folder.
- 3Run each command above against background.js and manifest.json.
- 4Cross-check the IDs in step 4 against the extensions listed on chrome://extensions.
A live dynamic-analysis session sent `chrome.runtime.sendMessage('jpkfgepcmmchgfbjblnodjhldacghenp', {type: 'management:adblockers_disable'})` from an open `https://pie.org/` page. The callback fired with no `chrome.runtime.lastError`, confirming the extension accepted the command over the external channel. The same call from `https://www.google.com/` threw `TypeError: chrome.runtime.sendMessage is not a function`, confirming Chrome only exposes the channel to the pie.org origins listed in `externally_connectable`. Whether a given browser actually has any competitor disabled depends on which of the listed extensions are installed and enabled at the time.