Is Smart popup blocker safe?

High risk

Blocks popups, pop-unders, and overlays while you browse the web.

This extension automatically detects and blocks intrusive popups, hidden pop-unders, and overlays across major websites. It also provides a custom whitelist for trusted sites and is described as working without setup.

Smart Appv2.0.1Chrome Web Store
79Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Remote server can replace all ad-blocking rules via declarativeNetRequest

Every 24h, and on install, this extension asks popblockersmart.com if rules need updating.

If yes, it fetches a ruleset from a second URL and replaces every blocking rule, a channel that could disable ad-blocking or allow-list attackers.

Severity
High unwanted
Type
Unexpected
CWE
CWE-829
Source
Dynamic sandbox
What actually happens
You did this

Every 24 hours (and at install), the extension contacts the operator's server to check for rule updates.

The extension did this

The server can supply an entirely new set of network blocking rules that replace all existing ones without notifying the user.

There is no user consent step, no changelog, and no integrity check on the rules payload beyond the operator's own version number.

The code that does this

Server-controlled rule replacement, ntu_p_do.js:1-65

Readable version
async function replaceNetworkRules(serverResponse) {  try {    const rulesUrl = serverResponse["IxSE"];       // URL of rules JSON — server-controlled    const serverVersion = serverResponse["uhML"];   // version number    const versionKey = 'net_item_uhML';    const stored = await chrome.storage.local.get([versionKey]);    if (stored[versionKey] !== undefined && stored[versionKey] >= serverVersion) {      return;  // already at this version, skip    }    const rulesPayload = await (await fetch(rulesUrl)).json();  // fetch from server-controlled URL    const existingRules = await chrome.declarativeNetRequest.getDynamicRules();    const existingIds = existingRules.map(r => r.id);    // Remove ALL existing dynamic rules and replace with server-provided ones    await chrome.declarativeNetRequest.updateDynamicRules({      removeRuleIds: existingIds,      addRules: rulesPayload    });    await chrome.storage.local.set({ [versionKey]: serverVersion });  } catch (e) {}}
When this fires

Every 1 day

The updateNetRulesAlarm fires every 60 minutes; actual network fetch is gated to once per 24 hours via the NFX timestamp stored in chrome.storage.local.

Servers involved in remote rule injection
    • popblockersmart.com

    Update coordinator: returns the URL of the actual rules JSON file and a version number. Also receives install ID and runtime ID on each poll.

What an operator could do with this channel

Because the rules URL is delivered at runtime from a server the operator controls, the entire declarativeNetRequest dynamic ruleset can be swapped for any content — including rules that allow-list ad networks, redirect specific domains, or suppress blocking on particular sites. The extension provides no mechanism for users to audit or revert these changes. The update runs in the background service worker without user notification.

Install-time upload of all open tab hostnames to popblockersmart.com

On install, this ad-blocker queries every open tab and sends the hostnames of those pages, plus a tab count, to popblockersmart.com before setup finishes, giving the operator a browsing snapshot linked to the extension's runtime ID.

Severity
High unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You install the extension from the Chrome Web Store.

The extension did this

The extension reads the hostname of every tab you have open and sends the full list to popblockersmart.com.

This happens automatically during the onInstalled handler, no user interaction beyond installation is required.

Data sent to popblockersmart.com/register_install/ on every install
  • Open tab hostnames
    mail.google.com,github.com,news.ycombinator.com,reddit.com

    The domain names of every browser tab you had open at the moment of install, a snapshot of your browsing session.

  • Total tab count
    12

    How many browser tabs you had open, regardless of whether the hostnames were deduplicated.

  • Extension runtime ID
    okmgbbamdmcnbbnamaegggpglkepfpja

    The Chrome-assigned runtime identifier for this install of the extension, sent as the crx= parameter.

The code that does this

Tab hostname collection and exfil URL construction (service_worker.js:7-19)

Readable version
async function M() {  const hostnames = [];  const tabs = await chrome.tabs.query({});  // all open tabs, all windows  for (const tab of tabs) {    try {      const url = new URL(tab.url);      const hostname = url.hostname;      if (!hostnames.includes(hostname)) {        hostnames.push(hostname);      }    } catch (e) {}  }  // constructs: https://popblockersmart.com/register_install/?crx=<runtimeId>&d=<hostnames>&tc=<tabCount>  return `${baseUrl()}/register_install/?crx=${chrome.runtime.id}&d=${hostnames.join(",")}&tc=${tabs.length}`;}
Captured request
GEThttps://popblockersmart.com/register_install/?crx=okmgbbamdmcnbbnamaegggpglkepfpja&d=mail.google.com,github.com,news.ycombinator.com,reddit.com,en.wikipedia.org&tc=8&i_id=default

JSON response sets i_id (install ID) and three obfuscated tracking parameters (_sw_s_fGyG_p1Value, _sw_s_fGyG_p2Value, _sw_s_fGyG_p3Value) stored in chrome.storage.local for later visit-tracking use.

Headers
credentials
include
Where install-time browsing data is sent
    • popblockersmart.com

    Operator-controlled server; receives the full list of open tab hostnames, tab count, and extension runtime ID at install time.

Server-planted patterns trigger visit-count beacon to popblockersmart.com

At install, the operator's server plants three obfuscated parameters (two hostname prefixes, one path) in storage.

Each load, a script checks the URL; a match ups a counter added to later popblockersmart.com calls, incl. uninstall.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You navigate to a page whose hostname and path match server-planted patterns stored at install time.

The extension did this

The extension increments a visit counter and reports the running total to popblockersmart.com on the next outbound call.

The specific pages being monitored are not visible in the extension code; they are set remotely at install time using obfuscated storage keys.

What's stored on your device

These obfuscated keys define which pages trigger the visit beacon, server-delivered at install. gcnt is the visit count sent each ping.

Location
chrome.storage.local keys _sw_s_fGyG_p1, _sw_s_fGyG_p2, _sw_s_fGyG_p3
Contents
{  "gcnt": 7,  "_sw_s_fGyG_p1": "<hostname prefix 1 — set by server at install>",  "_sw_s_fGyG_p2": "<hostname prefix 2 — set by server at install>",  "_sw_s_fGyG_p3": "<pathname — set by server at install>"}
The code that does this

Visit-match check (qfbpwam.js:18-32) and counter increment (service_worker.js:328-347)

Readable version

Content script: check page against server-planted patterns

(async function() {  const { _sw_s_fGyG_p1: p1, _sw_s_fGyG_p2: p2, _sw_s_fGyG_p3: path } =    await chrome.storage.local.get(['_sw_s_fGyG_p1', '_sw_s_fGyG_p2', '_sw_s_fGyG_p3']);  if (!p1 || !p2 || !path) return;  // tracking not configured  // Signal service worker if this page matches server-chosen patterns  if ((location.hostname.startsWith(p1) || location.hostname.startsWith(p2))      && location.pathname === path) {    chrome.runtime.sendMessage({ _sw_s_fGyG: 1 });  }})();

Service worker: batch-increment visit counter and push to uninstall URL

function incrementVisitCounter() {  pendingCount++;  // accumulate  if (!debounceActive) {    const timer = setTimeout(() => {      chrome.storage.local.get({ gcnt: 0 }, (stored) => {        let newTotal = stored.gcnt + pendingCount;        chrome.storage.local.set({ gcnt: newTotal })          .then(() => { updateUninstallUrl(); })  // gcnt appended to uninstall URL          .catch(() => {});        pendingCount = 0;      });      debounceActive = false;    }, 5000);  // batch for 5 seconds    debounceActive = true;  }}
Where the visit count is reported
    • popblockersmart.com

    Receives the gcnt visit counter as a query parameter on all future outbound calls, including the uninstall URL (setUninstallURL) and periodic re-registration pings.

+1 more finding not shown

What it can do

Permissions this extension asks for, as declared in version 2.0.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Schedule its own background tasks

    alarms

  • See the address and title of every tab you have open

    tabs

  • Store data in your browser

    storage

  • Store an unlimited amount of data in your browser

    unlimitedStorage

  • Block and redirect the requests your browser makes

    declarativeNetRequest

  • Watch every request your browser makes

    webRequest

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026okmgbbamdmcnbbnamaegggpglkepfpja