Is Popup Blocker Max safe?

Medium risk

Popup Blocker Max is medium risk. Once daily, Popup Blocker Max GETs popupblockermax.com with a per-install token, runtime ID, popups blocked, and Google visits since last update. Dynamic analysis confirmed the counters transmit verbatim to profile each install.

Popup Blocker Maxv1.1.1.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

SeverityMEDIUM
ClassMALICIOUS
TypeUnexpected
CWECWE-359
SourceAI SANDBOX

Daily beacon sends per-user token and usage counts to popupblockermax.com

Once daily, Popup Blocker Max GETs popupblockermax.com with a per-install token, runtime ID, popups blocked, and Google visits since last update.

Dynamic analysis confirmed the counters transmit verbatim to profile each install.

01EvidenceCAUSE EFFECT
What actually happens
You did this

You install Popup Blocker Max and use it normally.

No special action required, the beacon fires on a daily schedule regardless of what pages you visit.

The extension did this

Once per day, the extension sends your unique installation token and accumulated usage counts to popupblockermax.com.

The request includes a persistent identifier the server assigned at install time, allowing the developer to track each installation across days and browser restarts.

02EvidenceNETWORK CAPTURE
Captured request
GEThttps://popupblockermax.com/r/filters/?extID=chlalkigiloegdhejmihamhibleebceb&bcounter=3&scounter=7&ucounter=0&mark=<planted-marker-value>
JSON array of filter-list update objects. Extension uses response to update declarativeNetRequest rules. A planted marker value was confirmed verbatim in the captured request URL, confirming the mark parameter leaves the device.
03EvidenceFIELD TABLE
Query parameters sent with every daily beacon:
FieldValueWhy it matters
Your installation token (mark)
<planted-marker-value>Server-assigned ID stored at install, sent with every update request. Lets the server recognize your install across restarts and updates.
Extension runtime ID (extID)
chlalkigiloegdhejmihamhibleebcebThe Chrome-assigned runtime ID for this install of the extension. Changes on reinstall but is stable across browser restarts.
Blocked popup count (bcounter)
3How many popups the extension blocked since the previous daily update. Reveals relative browsing activity.
Google search count (scounter)
7How many times you visited a google.*/search page since the previous daily update.
Update cycle count (ucounter)
0Computed from elapsed time since lastUpdate. Represents the approximate number of missed update windows.
04EvidenceCODE COMPARE
The code that does this

The URL builder and updater function from the extension's service worker:

What it actually does
Beacon URL builder
// Builds the telemetry URL with usage counters and persistent token const buildBeaconUrl = async (baseUrl, extensionInstance) => { let url = baseUrl; url += '?extID=' + chrome.runtime.id; // runtime ID const { blockedCounter, searchCounter, lastUpdate } = await chrome.storage.local.get({ blockedCounter: 0, searchCounter: 0, lastUpdate: 0 }); const updateCounter = !lastUpdate ? 0 : parseInt(Date.now() - lastUpdate / 3600000); url += '&bcounter=' + blockedCounter; // popup blocks since last update url += '&scounter=' + searchCounter; // Google search visits since last update url += '&ucounter=' + updateCounter; if (extensionInstance) { url += '&mark=' + extensionInstance; // persistent per-install server token } return url; };
Updater with 24h guard and counter reset
// Alarm fires hourly; updater checks nextUpdate guard (24h window) await chrome.alarms.create('updater', { delayInMinutes: 60, periodInMinutes: 60 }); const updater = async () => { const { nextUpdate } = await chrome.storage.local.get({ nextUpdate: 0 }); if (Date.now() < nextUpdate) return; // skip if < 24h since last update const { extensionInstance } = await chrome.storage.local.get(['extensionInstance']); const response = await fetch(await buildBeaconUrl(BASE_URL + '/r/filters/', extensionInstance)); // ... process filter updates ... await chrome.storage.local.set({ nextUpdate: Date.now() + 24 * 3600 * 1e3, // next fire in 24h blockedCounter: 0, searchCounter: 0 }); };
05EvidenceTHIRD PARTY LIST
Where the beacon data is sent:
  • popupblockermax.com

    Developer's own domain. Receives the daily beacon with the install token and usage counters. Also serves filter-list updates in the same response.

Updated 10 September 2026ajjpfpfbgjcgghkgbcgmifkonjdldgkh