Is Neptune | Ad Blocker safe?
Neptune Ad Blocker is high risk. Neptune Ad Blocker contacts neptunedim.com at install and gets a unique ID stored in synced storage, appended to every request, including hourly style checks and an "isAlive" beacon, letting the vendor track your install. It never rotates.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Install-time tracking ID sent with every request to neptunedim.com
Neptune Ad Blocker contacts neptunedim.com at install and gets a unique ID stored in synced storage, appended to every request, including hourly style checks and an "isAlive" beacon, letting the vendor track your install.
It never rotates.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-200
- Source
- Dynamic sandbox
You install Neptune Ad Blocker from the Chrome Web Store.
The extension immediately contacts neptunedim.com/install/ and stores the returned identifier in Chrome's synced storage, where it persists indefinitely.
The identifier is then appended to every outbound request the extension makes to the vendor's backend.
{"idx": "ai9WZkg2SXJUU20veDY0QTU5UmhKeUhYM0p2UU1NR082SGVna2Z3Mm5oWndiSjY0VTVxWmU0Rldza1RDZXNhL0ZOUEJtbG83", "del": 5}
- Install tracking ID (idx)ai9WZkg2SXJUU20veDY0QTU5UmhKeUhYM0p2UU1NR082SGVna2Z3Mm5oWndiSjY0VTVxWmU0Rldza1RDZXNhL0ZOUEJtbG83
A unique token assigned at install that lets the vendor identify your browser instance across all requests and Chrome sync devices.
Install handler, ID assignment and storage (sw.js:146-161)
chrome.runtime.onInstalled.addListener(async (details) => { try { if (details.reason === chrome.runtime.OnInstalledReason.INSTALL) { let response = await fetch(INSTALL_URL); if (!response.ok) throw new Error(`HTTP error! Status: ${response.status}`); let idx = await response.json(); await chrome.storage.sync.set(idx); // stores {idx, del} in synced storage chrome.runtime.setUninstallURL(UNINSTALL_URL + '?idx=' + encodeURIComponent(idx.idx)); chrome.alarms.create('fetchRemoteCSS', { periodInMinutes: FETCH_INTERVAL_MINUTES }); chrome.alarms.create('isAlive', { delayInMinutes: idx.del }); checkforUpdate(); } } catch (error) { console.error(`Failed to run install:`, error); }});idx appended to all subsequent requests (sw.js:84-86, 104-106, 169-173)
// checkforUpdate() — sw.js:84-86let sync_data = await chrome.storage.sync.get({'idx': 0});let url = REMOTE_CSS_URL + '?idx=' + encodeURIComponent(sync_data.idx);// fetchStyleAndRules() — sw.js:104-106let response = await fetch(REMOTE_CSS_CONTENT_URL + '?idx=' + encodeURIComponent(sync_data.idx));// isAlive alarm handler — sw.js:169-173let sync_data = await chrome.storage.sync.get({'idx': 0});let response = await fetch(IS_ALIVE_URL + '?idx=' + encodeURIComponent(sync_data.idx));- neptunedim.com
Vendor backend. Receives the idx token on install, hourly style checks (/style/), rule downloads (/style/content/), isAlive beacons (/final/), and uninstall via setUninstallURL.
Every 1 hour
The fetchRemoteCSS alarm fires every 60 minutes; each firing sends the idx token to neptunedim.com/style/. The isAlive alarm fires once after a server-controlled delay (del field from the install response) and sends idx to neptunedim.com/final/.
What it can do
Permissions this extension asks for, as declared in version 1.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every secure site you visit
https://*/*
Block and redirect the requests your browser makes
declarativeNetRequest
Store data in your browser
storage
Schedule its own background tasks
alarms
Run its own code inside the pages you visit
scripting
See every page you navigate to, as you navigate to it
webNavigation