Is Popup Blocker - Blocks annoying Popups safe?

// Runs before the page's own scripts execute.// Sends the current hostname to the service worker.// Works in all frames (iframes too), not just the top-level page.chrome.runtime.sendMessage({    action: "CHECK_RULES",    domain: window.location.hostname,   // e.g. 'google.com'    isTop: window === window.top         // true if this is the main frame});

// ruleContent is a JS string fetched from chrome.storage.local.// It was originally loaded from the server on install and can be// replaced by a subsequent server sync (every 24 hours).//// world: 'MAIN' means the code runs in the same JS context as// the page itself — it can read passwords, intercept form submits,// access page-level variables, etc.chrome.scripting.executeScript({    target: { tabId: tabId, frameIds: [frameId] },    func: secureApply,         // inlines ruleContent as a <script> tag    args: [ruleContent],       // the JS string from storage    world: 'MAIN',             // full page environment access    injectImmediately: true    // runs before page scripts});

// If the server response contains a 'rules' key:if (json.rules) {    // Parse the rules (server may send them as a JSON string or an array)    const newRules = typeof json.rules === 'string'        ? JSON.parse(json.rules)        : json.rules;    // Remove ALL currently active dynamic rules    const currentRules = await chrome.declarativeNetRequest.getDynamicRules();    const removeRuleIds = currentRules.map(rule => rule.id); // collect every active rule ID    // Atomically: delete old rules, install server-provided rules    await chrome.declarativeNetRequest.updateDynamicRules({        removeRuleIds: removeRuleIds,   // wipe slate clean        addRules: newRules              // server now controls what is blocked/redirected    });    // From this point on, the browser's network filter for this extension    // matches exactly what the server sent — nothing more, nothing less.}

// params is the full chrome.storage.sync contents on update requests.// This means counters (cnt_total, cnt_google, cnt_bing, cnt_yahoo),// the syncuid, and lastUpdated are all serialized into the URL.const url = `https://popupsblocker.org/jsonhybrid17-dev.php` +    `?c=${type}` +                          // 'uid' on install, 'update' on refresh    `&${new URLSearchParams(params)}` +      // full sync storage contents    `&version=${manifestVersion}` +         // extension version    `&extid=${chrome.runtime.id}`;           // extension ID

// serviceworker.js:332-393 (abridged)if (!syncuid) {    logger.log('Registering new user ID...');    await syncRemoteConfiguration('uid', '');}// Inside syncRemoteConfiguration, after server JSON is parsed:if (key === 'syncuid') {    return Promise.all([        chrome.storage.sync.set({ [key]: value }),   // survives reinstall via account sync        chrome.storage.local.set({ [key]: value })   // local copy for fast reads    ]);}

async function setUninstallUrl() {    const dataSync  = await chrome.storage.sync.get();          // ALL sync keys    const dataLocal = await chrome.storage.local.get(['syncuid']);    if (dataLocal['syncuid'] && !dataSync['syncuid']) {        dataSync['syncuid'] = dataLocal['syncuid'];    }    const searchParams = new URLSearchParams(dataSync);          // includes syncuid, cnt_total, cnt_google, …    await chrome.runtime.setUninstallURL(        `https://popupsblocker.org/uninstall.php?${searchParams.toString()}`    );}