Is Popup Blocker (strict) safe?

Popup Blocker (strict) intercepts and blocks popup and tab-open requests on every page, presenting a confirmation UI that any page script can inject fake entries into.

The extension injects a content script on all URLs that captures window.open and tab-creation calls before they execute, then renders a confirmation iframe asking the user whether to allow, deny, or redirect each popup. The confirmation iframe registers a postMessage listener with no origin check, meaning any page can send crafted requests into it and cause the UI to display attacker-controlled entries; if the user clicks Allow on one, the extension opens the attacker-supplied URL via chrome.tabs.create.

Part of this rating comes from analysis signals we haven't published as detailed findings yet.