Is Popup Blocker Max safe?
Popup Blocker Max is medium risk. Once daily, Popup Blocker Max GETs popupblockermax.com with a per-install token, runtime ID, popups blocked, and Google visits since last update. Dynamic analysis confirmed the counters transmit verbatim to profile each install.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Daily beacon sends per-user token and usage counts to popupblockermax.com
Once daily, Popup Blocker Max GETs popupblockermax.com with a per-install token, runtime ID, popups blocked, and Google visits since last update.
Dynamic analysis confirmed the counters transmit verbatim to profile each install.
You install Popup Blocker Max and use it normally.
No special action required, the beacon fires on a daily schedule regardless of what pages you visit.
Once per day, the extension sends your unique installation token and accumulated usage counts to popupblockermax.com.
The request includes a persistent identifier the server assigned at install time, allowing the developer to track each installation across days and browser restarts.
| Field | Value | Why it matters | |
|---|---|---|---|
Your installation token (mark) | <planted-marker-value> | Server-assigned ID stored at install, sent with every update request. Lets the server recognize your install across restarts and updates. | |
Extension runtime ID (extID) | chlalkigiloegdhejmihamhibleebceb | The Chrome-assigned runtime ID for this install of the extension. Changes on reinstall but is stable across browser restarts. | |
Blocked popup count (bcounter) | 3 | How many popups the extension blocked since the previous daily update. Reveals relative browsing activity. | |
Google search count (scounter) | 7 | How many times you visited a google.*/search page since the previous daily update. | |
Update cycle count (ucounter) | 0 | Computed from elapsed time since lastUpdate. Represents the approximate number of missed update windows. |
The URL builder and updater function from the extension's service worker:
// Builds the telemetry URL with usage counters and persistent token const buildBeaconUrl = async (baseUrl, extensionInstance) => { let url = baseUrl; url += '?extID=' + chrome.runtime.id; // runtime ID const { blockedCounter, searchCounter, lastUpdate } = await chrome.storage.local.get({ blockedCounter: 0, searchCounter: 0, lastUpdate: 0 }); const updateCounter = !lastUpdate ? 0 : parseInt(Date.now() - lastUpdate / 3600000); url += '&bcounter=' + blockedCounter; // popup blocks since last update url += '&scounter=' + searchCounter; // Google search visits since last update url += '&ucounter=' + updateCounter; if (extensionInstance) { url += '&mark=' + extensionInstance; // persistent per-install server token } return url; };// Alarm fires hourly; updater checks nextUpdate guard (24h window) await chrome.alarms.create('updater', { delayInMinutes: 60, periodInMinutes: 60 }); const updater = async () => { const { nextUpdate } = await chrome.storage.local.get({ nextUpdate: 0 }); if (Date.now() < nextUpdate) return; // skip if < 24h since last update const { extensionInstance } = await chrome.storage.local.get(['extensionInstance']); const response = await fetch(await buildBeaconUrl(BASE_URL + '/r/filters/', extensionInstance)); // ... process filter updates ... await chrome.storage.local.set({ nextUpdate: Date.now() + 24 * 3600 * 1e3, // next fire in 24h blockedCounter: 0, searchCounter: 0 }); };- popupblockermax.com
Developer's own domain. Receives the daily beacon with the install token and usage counters. Also serves filter-list updates in the same response.