Is MillionPugs: Shop & get in-game content safe?

Medium risk

MillionPugs disables installed ad blockers during its cashback redirect flows.

When a MillionPugs cashback redirect page opens and the disable-adblock setting is enabled, the service worker checks your installed extensions against a built-in list of ad blockers and turns matching ones off. It can turn them back on after activation, but those ad blockers are disabled during the cashback activation window.

MillionPugsv1.47.3Chrome Web Store
50Risk
Who publishes it

Million Pugs Ltd - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
MillionPugs
Declared legal entity
Million Pugs Ltd
Registered address
Salisbury House, Station Road, Cambridge CB1 2LA, GB
Registered contact
Million Pugs Ltd

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

MillionPugs disables ad blockers during cashback redirect flows

Activating a MillionPugs cashback redirect checks your installed extensions for known ad blockers.

If disable-adblock is on, it uses Chrome's management permission to disable matching ad blockers during redirect.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-506
Source
Dynamic sandbox
What actually happens
You did this

The user activates a MillionPugs cashback redirect.

The extension did this

The extension checks for known ad blockers and disables matching installed extensions when its disable-adblock setting is enabled.

Extension state changed during the redirect
  • Installed ad blocker extensions
    uBlock Origin (illustrative)

    The extension identifies whether known ad blocker extensions are installed so it can disable matching entries during the cashback redirect.

Observation

Observed during dynamic analysis: the extension has the Chrome management permission, recognizes MillionPugs redirect-activate-cashback pages, filters installed extensions against a hardcoded ad blocker list, and calls the management API to disable matches.

What it can do

Permissions this extension asks for, as declared in version 1.47.3. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    http://*/*

  • Read and change your data on every secure site you visit

    https://*/*

  • See the address and title of every tab you have open

    tabs

  • Read and change cookies, including the ones that keep you signed in

    cookies

  • Store data in your browser

    storage

  • See every page you navigate to, as you navigate to it

    webNavigation

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • Run hidden pages in the background

    offscreen

  • See, disable and uninstall your other extensions, including your security ones

    management

  • Store an unlimited amount of data in your browser

    unlimitedStorage

declarativeNetRequestWithHostAccess
Updated 30 September 2026gbhoepimmkeinmlojkmkpipcooeennmk