Is Popup Blocker Gold safe?

High risk

Popup Blocker Gold is high risk. Popup Blocker Gold contacts popupblockergold.com every 60 min for fresh rules: /rules/?clientId=... returns a rules-file URL, fetched and applied directly to declarativeNetRequest with no prompt. The operator can block any site anytime.…

Block Studiov1.8.0Chrome Web Store
76Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Server remotely controls your ad-blocking rules without your knowledge

Popup Blocker Gold contacts popupblockergold.com every 60 min for fresh rules: /rules/?clientId=... returns a rules-file URL, fetched and applied directly to declarativeNetRequest with no prompt.

The operator can block any site anytime.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

You install Popup Blocker Gold and browse normally.

No user action is needed, the update cycle begins automatically on install and repeats every 60 minutes.

The extension did this

The extension without notifying the user downloads a fresh ruleset from the developer's server and replaces all current network rules with the new ones.

Two sequential fetches retrieve the rules: first to /rules/ for the index, then to the URL returned in that response for the actual ruleset.

Captured request
GEThttps://popupblockergold.com/rules/?clientId=ai9WZkg2SXJUU20veDY0QTU5UmhKeUhYM0p2UU1NR0I3bldta1BvL25SWXpHZUVYejEwRjZIeVF2RHFFbGNlbmZOVFVZbWtR

JSON with 'url' pointing to the rules file (e.g. /rules/update.json?clientId=...) and a 'version' field used to skip unchanged rulesets.

The code that does this

Remote rules fetch and apply, worker.js

Readable version
// Every 60 minutes (and on first run), fetch a fresh ruleset from the serverconst updateNetRules = async () => {  const { updateTimestamp, clientId, reulesVersion } =    await chrome.storage.local.get(['updateTimestamp', 'clientId', 'reulesVersion']);  // Skip if the last update was within updatePeriodMs (86400000 ms = 24h cache window)  if (updateTimestamp && Date.now() - updateTimestamp < extensionInfo.updatePeriodMs)    return;  // Step 1: fetch the rules index — returns { url, version }  const indexResp = await fetch(extensionInfo.updateUrl + '?clientId=' + clientId);  const { url: rulesFileUrl, version: serverVersion } = await indexResp.json();  // Step 2: only apply if the server has a newer version  if (!reulesVersion || reulesVersion < serverVersion) {    const rulesResp = await fetch(rulesFileUrl + '?clientId=' + clientId);    const rulesPayload = await rulesResp.json();    await applyRules(rulesPayload); // replaces ALL dynamic rules  }  await chrome.storage.local.set({ updateTimestamp: Date.now() });};// Wipe every existing dynamic rule, then install the server-supplied setconst applyRules = async (payload) => {  const existingIds = (await chrome.declarativeNetRequest.getDynamicRules()).map(r => r.id);  await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existingIds });  await chrome.declarativeNetRequest.updateDynamicRules({ addRules: payload.rules });  await chrome.storage.local.set({ badge: payload.badge });};
When this fires

Every 1 hour

The extension creates a Chrome alarm named 'updateAlarm' that fires every 60 minutes, re-running the full two-step rules fetch and replace cycle for as long as the extension is installed.

What a attacker-controlled ruleset could do

declarativeNetRequest rules can block, redirect, or modify the headers of any HTTP request in the browser. A server-supplied ruleset could redirect security update endpoints, block antivirus telemetry, or forward traffic destined for one domain to another — all without user confirmation. The extension's manifest already grants the `declarativeNetRequest` permission, so no additional prompt would appear when new rules are applied.

Extension assigns a permanent tracking ID to your browser on install

On install, Popup Blocker Gold contacts popupblockergold.com/spark/ and gets a clientId stored locally, seen in every later request captured.

It persists until uninstall and rides in the uninstall-survey URL, linking removal to history.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install Popup Blocker Gold for the first time.

No opt-in, no disclosure, the ID assignment happens automatically in the background within seconds of install.

The extension did this

The extension fetches a unique identifier from the developer's server and stores it in your browser, then attaches it to every subsequent request to popupblockergold.com.

The same ID is also embedded in the uninstall URL so it can be linked to any later uninstall event.

Captured request
GEThttps://popupblockergold.com/spark/

JSON response with 'clientId' (a base64-encoded opaque string) and 'finishedMin' (delay before the post-install /finished/ beacon fires).

The code that does this

clientId assignment and transmission, worker.js

Readable version
chrome.runtime.onInstalled.addListener((event) => {  if (event.reason === 'install') {    // On first install: contact the developer's server to get a permanent tracking ID    fetch('https://popupblockergold.com/spark/')      .then(r => r.json())      .then(response => {        // Store the ID permanently in local extension storage        chrome.storage.local.set({          clientId: response.clientId,          firstRun: false        });        // Schedule a post-install engagement beacon after a server-specified delay        chrome.alarms.create('finishedAlarm', { delayInMinutes: response.finishedMin });        // Embed the same ID in the uninstall URL so uninstalls can be tied back to this session        chrome.runtime.setUninstallURL(          'https://popupblockergold.com/rm/?clientId=' + encodeURIComponent(response.clientId)        );        startApp(); // proceed to load extension functionality      });  }});
What's stored on your device

The identifier the developer's server issued your browser on install. Sent with every request to popupblockergold.com until uninstall.

Location
chrome.storage.local key 'clientId'
Contents
ai9WZkg2SXJUU20veDY0QTU5UmhKeUhYM0p2UU1NR0I3bldta1BvL25SWXpHZUVYejEwRjZIeVF2RHFFbGNlbmZOVFVZbWtR
Destinations that receive the clientId
    • popupblockergold.com

    Developer's own server. Receives clientId on rules fetches (/rules/), rules downloads (/rules/update.json), install beacon (/finished/), and uninstall (/rm/).

What it can do

Permissions this extension asks for, as declared in version 1.8.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

  • Schedule its own background tasks

    alarms

  • Block and redirect the requests your browser makes

    declarativeNetRequest

Updated 30 September 2026mlojegjchciohillknfbpiemdcloeemd