Is Popup Blocker Gold safe?
Popup Blocker Gold is high risk. Popup Blocker Gold contacts popupblockergold.com every 60 min for fresh rules: /rules/?clientId=... returns a rules-file URL, fetched and applied directly to declarativeNetRequest with no prompt. The operator can block any site anytime.…
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Server remotely controls your ad-blocking rules without your knowledge
Popup Blocker Gold contacts popupblockergold.com every 60 min for fresh rules: /rules/?clientId=... returns a rules-file URL, fetched and applied directly to declarativeNetRequest with no prompt.
The operator can block any site anytime.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
You install Popup Blocker Gold and browse normally.
No user action is needed, the update cycle begins automatically on install and repeats every 60 minutes.
The extension without notifying the user downloads a fresh ruleset from the developer's server and replaces all current network rules with the new ones.
Two sequential fetches retrieve the rules: first to /rules/ for the index, then to the URL returned in that response for the actual ruleset.
JSON with 'url' pointing to the rules file (e.g. /rules/update.json?clientId=...) and a 'version' field used to skip unchanged rulesets.
Remote rules fetch and apply, worker.js
// Every 60 minutes (and on first run), fetch a fresh ruleset from the serverconst updateNetRules = async () => { const { updateTimestamp, clientId, reulesVersion } = await chrome.storage.local.get(['updateTimestamp', 'clientId', 'reulesVersion']); // Skip if the last update was within updatePeriodMs (86400000 ms = 24h cache window) if (updateTimestamp && Date.now() - updateTimestamp < extensionInfo.updatePeriodMs) return; // Step 1: fetch the rules index — returns { url, version } const indexResp = await fetch(extensionInfo.updateUrl + '?clientId=' + clientId); const { url: rulesFileUrl, version: serverVersion } = await indexResp.json(); // Step 2: only apply if the server has a newer version if (!reulesVersion || reulesVersion < serverVersion) { const rulesResp = await fetch(rulesFileUrl + '?clientId=' + clientId); const rulesPayload = await rulesResp.json(); await applyRules(rulesPayload); // replaces ALL dynamic rules } await chrome.storage.local.set({ updateTimestamp: Date.now() });};// Wipe every existing dynamic rule, then install the server-supplied setconst applyRules = async (payload) => { const existingIds = (await chrome.declarativeNetRequest.getDynamicRules()).map(r => r.id); await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existingIds }); await chrome.declarativeNetRequest.updateDynamicRules({ addRules: payload.rules }); await chrome.storage.local.set({ badge: payload.badge });};Every 1 hour
The extension creates a Chrome alarm named 'updateAlarm' that fires every 60 minutes, re-running the full two-step rules fetch and replace cycle for as long as the extension is installed.
declarativeNetRequest rules can block, redirect, or modify the headers of any HTTP request in the browser. A server-supplied ruleset could redirect security update endpoints, block antivirus telemetry, or forward traffic destined for one domain to another — all without user confirmation. The extension's manifest already grants the `declarativeNetRequest` permission, so no additional prompt would appear when new rules are applied.
Extension assigns a permanent tracking ID to your browser on install
On install, Popup Blocker Gold contacts popupblockergold.com/spark/ and gets a clientId stored locally, seen in every later request captured.
It persists until uninstall and rides in the uninstall-survey URL, linking removal to history.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install Popup Blocker Gold for the first time.
No opt-in, no disclosure, the ID assignment happens automatically in the background within seconds of install.
The extension fetches a unique identifier from the developer's server and stores it in your browser, then attaches it to every subsequent request to popupblockergold.com.
The same ID is also embedded in the uninstall URL so it can be linked to any later uninstall event.
JSON response with 'clientId' (a base64-encoded opaque string) and 'finishedMin' (delay before the post-install /finished/ beacon fires).
clientId assignment and transmission, worker.js
chrome.runtime.onInstalled.addListener((event) => { if (event.reason === 'install') { // On first install: contact the developer's server to get a permanent tracking ID fetch('https://popupblockergold.com/spark/') .then(r => r.json()) .then(response => { // Store the ID permanently in local extension storage chrome.storage.local.set({ clientId: response.clientId, firstRun: false }); // Schedule a post-install engagement beacon after a server-specified delay chrome.alarms.create('finishedAlarm', { delayInMinutes: response.finishedMin }); // Embed the same ID in the uninstall URL so uninstalls can be tied back to this session chrome.runtime.setUninstallURL( 'https://popupblockergold.com/rm/?clientId=' + encodeURIComponent(response.clientId) ); startApp(); // proceed to load extension functionality }); }});The identifier the developer's server issued your browser on install. Sent with every request to popupblockergold.com until uninstall.
- Location
- chrome.storage.local key 'clientId'
ai9WZkg2SXJUU20veDY0QTU5UmhKeUhYM0p2UU1NR0I3bldta1BvL25SWXpHZUVYejEwRjZIeVF2RHFFbGNlbmZOVFVZbWtR- popupblockergold.com
Developer's own server. Receives clientId on rules fetches (/rules/), rules downloads (/rules/update.json), install beacon (/finished/), and uninstall (/rm/).
What it can do
Permissions this extension asks for, as declared in version 1.8.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Schedule its own background tasks
alarms
Block and redirect the requests your browser makes
declarativeNetRequest