Is Smart popup blocker safe?
Blocks popups, pop-unders, and overlays while you browse the web.
This extension automatically detects and blocks intrusive popups, hidden pop-unders, and overlays across major websites. It also provides a custom whitelist for trusted sites and is described as working without setup.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Remote server can replace all ad-blocking rules via declarativeNetRequest
Every 24h, and on install, this extension asks popblockersmart.com if rules need updating.
If yes, it fetches a ruleset from a second URL and replaces every blocking rule, a channel that could disable ad-blocking or allow-list attackers.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-829
- Source
- Dynamic sandbox
Every 24 hours (and at install), the extension contacts the operator's server to check for rule updates.
The server can supply an entirely new set of network blocking rules that replace all existing ones without notifying the user.
There is no user consent step, no changelog, and no integrity check on the rules payload beyond the operator's own version number.
Server-controlled rule replacement, ntu_p_do.js:1-65
async function replaceNetworkRules(serverResponse) { try { const rulesUrl = serverResponse["IxSE"]; // URL of rules JSON — server-controlled const serverVersion = serverResponse["uhML"]; // version number const versionKey = 'net_item_uhML'; const stored = await chrome.storage.local.get([versionKey]); if (stored[versionKey] !== undefined && stored[versionKey] >= serverVersion) { return; // already at this version, skip } const rulesPayload = await (await fetch(rulesUrl)).json(); // fetch from server-controlled URL const existingRules = await chrome.declarativeNetRequest.getDynamicRules(); const existingIds = existingRules.map(r => r.id); // Remove ALL existing dynamic rules and replace with server-provided ones await chrome.declarativeNetRequest.updateDynamicRules({ removeRuleIds: existingIds, addRules: rulesPayload }); await chrome.storage.local.set({ [versionKey]: serverVersion }); } catch (e) {}}Every 1 day
The updateNetRulesAlarm fires every 60 minutes; actual network fetch is gated to once per 24 hours via the NFX timestamp stored in chrome.storage.local.
- popblockersmart.com
Update coordinator: returns the URL of the actual rules JSON file and a version number. Also receives install ID and runtime ID on each poll.
Because the rules URL is delivered at runtime from a server the operator controls, the entire declarativeNetRequest dynamic ruleset can be swapped for any content — including rules that allow-list ad networks, redirect specific domains, or suppress blocking on particular sites. The extension provides no mechanism for users to audit or revert these changes. The update runs in the background service worker without user notification.
Install-time upload of all open tab hostnames to popblockersmart.com
On install, this ad-blocker queries every open tab and sends the hostnames of those pages, plus a tab count, to popblockersmart.com before setup finishes, giving the operator a browsing snapshot linked to the extension's runtime ID.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You install the extension from the Chrome Web Store.
The extension reads the hostname of every tab you have open and sends the full list to popblockersmart.com.
This happens automatically during the onInstalled handler, no user interaction beyond installation is required.
- Open tab hostnamesmail.google.com,github.com,news.ycombinator.com,reddit.com
The domain names of every browser tab you had open at the moment of install, a snapshot of your browsing session.
- Total tab count12
How many browser tabs you had open, regardless of whether the hostnames were deduplicated.
- Extension runtime IDokmgbbamdmcnbbnamaegggpglkepfpja
The Chrome-assigned runtime identifier for this install of the extension, sent as the crx= parameter.
Tab hostname collection and exfil URL construction (service_worker.js:7-19)
async function M() { const hostnames = []; const tabs = await chrome.tabs.query({}); // all open tabs, all windows for (const tab of tabs) { try { const url = new URL(tab.url); const hostname = url.hostname; if (!hostnames.includes(hostname)) { hostnames.push(hostname); } } catch (e) {} } // constructs: https://popblockersmart.com/register_install/?crx=<runtimeId>&d=<hostnames>&tc=<tabCount> return `${baseUrl()}/register_install/?crx=${chrome.runtime.id}&d=${hostnames.join(",")}&tc=${tabs.length}`;}JSON response sets i_id (install ID) and three obfuscated tracking parameters (_sw_s_fGyG_p1Value, _sw_s_fGyG_p2Value, _sw_s_fGyG_p3Value) stored in chrome.storage.local for later visit-tracking use.
- credentials
- include
- popblockersmart.com
Operator-controlled server; receives the full list of open tab hostnames, tab count, and extension runtime ID at install time.
Server-planted patterns trigger visit-count beacon to popblockersmart.com
At install, the operator's server plants three obfuscated parameters (two hostname prefixes, one path) in storage.
Each load, a script checks the URL; a match ups a counter added to later popblockersmart.com calls, incl. uninstall.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You navigate to a page whose hostname and path match server-planted patterns stored at install time.
The extension increments a visit counter and reports the running total to popblockersmart.com on the next outbound call.
The specific pages being monitored are not visible in the extension code; they are set remotely at install time using obfuscated storage keys.
These obfuscated keys define which pages trigger the visit beacon, server-delivered at install. gcnt is the visit count sent each ping.
- Location
- chrome.storage.local keys _sw_s_fGyG_p1, _sw_s_fGyG_p2, _sw_s_fGyG_p3
{ "gcnt": 7, "_sw_s_fGyG_p1": "<hostname prefix 1 — set by server at install>", "_sw_s_fGyG_p2": "<hostname prefix 2 — set by server at install>", "_sw_s_fGyG_p3": "<pathname — set by server at install>"}Visit-match check (qfbpwam.js:18-32) and counter increment (service_worker.js:328-347)
Content script: check page against server-planted patterns
(async function() { const { _sw_s_fGyG_p1: p1, _sw_s_fGyG_p2: p2, _sw_s_fGyG_p3: path } = await chrome.storage.local.get(['_sw_s_fGyG_p1', '_sw_s_fGyG_p2', '_sw_s_fGyG_p3']); if (!p1 || !p2 || !path) return; // tracking not configured // Signal service worker if this page matches server-chosen patterns if ((location.hostname.startsWith(p1) || location.hostname.startsWith(p2)) && location.pathname === path) { chrome.runtime.sendMessage({ _sw_s_fGyG: 1 }); }})();Service worker: batch-increment visit counter and push to uninstall URL
function incrementVisitCounter() { pendingCount++; // accumulate if (!debounceActive) { const timer = setTimeout(() => { chrome.storage.local.get({ gcnt: 0 }, (stored) => { let newTotal = stored.gcnt + pendingCount; chrome.storage.local.set({ gcnt: newTotal }) .then(() => { updateUninstallUrl(); }) // gcnt appended to uninstall URL .catch(() => {}); pendingCount = 0; }); debounceActive = false; }, 5000); // batch for 5 seconds debounceActive = true; }}- popblockersmart.com
Receives the gcnt visit counter as a query parameter on all future outbound calls, including the uninstall URL (setUninstallURL) and periodic re-registration pings.
+1 more finding not shown
What it can do
Permissions this extension asks for, as declared in version 2.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Schedule its own background tasks
alarms
See the address and title of every tab you have open
tabs
Store data in your browser
storage
Store an unlimited amount of data in your browser
unlimitedStorage
Block and redirect the requests your browser makes
declarativeNetRequest
Watch every request your browser makes
webRequest
Run its own code inside the pages you visit
scripting