Is PixelBlock safe?

PixelBlock blocks email tracking pixels in Gmail and registers a permissive Trusted Types 'default' policy that relaxes Gmail's DOM-XSS protections.

PixelBlock runs only on mail.google.com and blocks known email open-tracking pixels using network rules (declarativeNetRequest) plus DOM-level scanning of proxied images; it sends no email content or browsing data to any server. To let its own helper scripts load, its content script installs a Trusted Types 'default' policy whose functions pass strings through unchanged, which disables Gmail's strict Trusted Types enforcement across the page for as long as the tab is open.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.