Is PixelBlock safe?

Low risk

PixelBlock blocks email tracking pixels in Gmail and registers a permissive Trusted Types 'default' policy that relaxes Gmail's DOM-XSS protections.

PixelBlock runs only on mail.google.com and blocks known email open-tracking pixels using network rules (declarativeNetRequest) plus DOM-level scanning of proxied images; it sends no email content or browsing data to any server. To let its own helper scripts load, its content script installs a Trusted Types 'default' policy whose functions pass strings through unchanged, which disables Gmail's strict Trusted Types enforcement across the page for as long as the tab is open.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.

omar.w.qureshiv2025.12.01Chrome Web Store
15Risk
Who publishes it

omar.w.qureshi - no other listings under this identity

What this publisher told the store about itself, and the other listings that told it the same thing.

Publisher
omar.w.qureshi

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

What it can do

Permissions this extension asks for, as declared in version 2025.12.01. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on googleusercontent.com

    *://*.googleusercontent.com/*

  • Read and change your data on mail.google.com

    *://mail.google.com/*

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026jmpmfcjnflbcoidlgapblgpgbilinlem