Is Popup Blocker safe?

Question

Accepted Answer

Popup Blocker is critical risk. When you install Popup Blocker, it fetches JavaScript code strings from its server (popupsblocker.org) and stores them locally. Every time you navigate to a page, the extension's content script sends your domain to the service worker, which retrieves the matching stored script and injects it directly into the page's MAIN execution environment — the same context your banking site, email provider, or social media account runs in. Because the server controls what code gets stored, any server update to those strings immediately changes what code runs on every matching site you visit. Our dynamic analysis confirmed this: the server returned 32 domain-keyed JavaScript strings on first install, and the extension immediately executed that server-sourced code in the MAIN world on the first navigation. When Popup Blocker installs, updates, or runs its daily sync, it contacts its server (popupsblocker.org) and asks for the current rule set. If the server returns a 'rules' key in its response, the extension immediately removes all its existing network filtering rules and replaces them with whatever the server provided — no user action required. Our dynamic analysis captured this: the extension fetched popupsblocker.org/jsonhybrid17-dev.php, received a response containing 4,472 redirect rules and 29 block rules, and then called chrome.declarativeNetRequest.updateDynamicRules to install them. Because these rules run at the browser's network layer before any page code sees the request, the server can use this mechanism to redirect or block any site's traffic at will.

Is Popup Blocker - Blocks annoying Popups safe?

Findings