Is Telegram Blur - Advanced Telegram Web Privacy safe?
Telegram Blur - Advanced Telegram Web Privacy contacts ads.brainosia.com from an all-sites content script.
The extension registers an ad-related content script on every website and fetches https://ads.brainosia.com/data.json when that script loads. This request is separate from the Telegram blur feature and can send normal browser request metadata to the ad server as users browse arbitrary sites.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Telegram Blur fetches an ad server on every website, not only Telegram
Telegram Blur runs a content script on every website you visit, not only Telegram.
On page load it automatically requests an ad list from ads.brainosia.com.
We observed this fire on three unrelated non-Telegram sites in testing.
- Severity
- Medium unwanted
- Type
- Unexpected
- CWE
- CWE-359
- Source
- Dynamic sandbox
You open any website, not just Telegram.
Telegram Blur's content script matches every page ("<all_urls>").
The extension automatically requests an ad list from ads.brainosia.com.
The request fires as soon as the page loads, before you touch the extension's UI.
- Page you're onhttps://www.wikipedia.org/
The site making the request, visible to ads.brainosia.com as the request's origin.
- Your IP address203.0.113.42
Your network address is visible to the ad server on every one of these requests.
- Browser detailsMozilla/5.0 (Windows NT 10.0; Win64; x64)
Standard request headers such as User-Agent travel with the request.
The ad fetch runs unconditionally on every page
// Runs on EVERY page, because manifest.json matches this script to "<all_urls>",// not just https://web.telegram.org/*let ads = [];console.log("LOG : ", window.location.href); // logs the current page URL to the console// Fetches an ad/affiliate list from a third-party ad server.// No user action, no consent prompt, fires on every page load.fetch("https://ads.brainosia.com/data.json?v=" + Math.random()) .then((response) => { if (!response.ok) { throw new Error("Failed to fetch ads"); } return response.json(); }) .then((response) => { ads = response; // holds the returned ad objects (each has a "link") in memory if (ads.length > 2) { console.log(ads); console.log("LOG :", ads[ads.length - 1].link); } if (!Array.isArray(ads) || ads.length === 0) { console.warn("No ads available"); } }) .catch((error) => { console.error("Error fetching ads:", error); });// Waits for a message (from the extension's own popup) naming one of the ad// links above, then shows a confirmation dialog before opening it in a tab.chrome.runtime.onMessage.addListener((request, sender, sendResponse) => { if (request.type === "confirm-redirect" && request.url) { let urls = ads.map((el) => el.link); if (urls.includes(request.url)) { alertify .confirm( request.interstitial ? "Advertisement" : "Are you sure?", request.interstitial ? `<div style="text-align: center;"> <img src="${request.interstitial}" style="max-width: 100%; max-height: 250px; border-radius: 8px;"> <p>Check out this ad</p> </div>` : `Do you want to visit this URL?<br><br> <div style="background: #f5f5f5; padding: 10px; border-radius: 4px;"> ${request.url} </div>`, function () { window.open(request.url, "_blank"); // opens the ad link in a new tab }, function () { // Cancel } ) .set({ labels: { ok: "Open", cancel: "Cancel" } }); } }});200 OK, JSON array of ad objects, each with a link field pointing to affiliate/ad destinations such as whop.com/toolsuite/buy-vip.
- ads.brainosia.com
Receives your page context, IP address, and browser headers on every website you visit, and returns affiliate ad links such as whop.com/toolsuite/buy-vip.
What it can do
Permissions this extension asks for, as declared in version 3.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on web.telegram.org
https://web.telegram.org/
Store data in your browser
storage
Run its own code inside the pages you visit
scripting
Where it sends data
Destinations our analysis observed Telegram Blur - Advanced Telegram Web Privacy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.
- ads.brainosia.com
Telegram Blur - Advanced Telegram Web Privacy sends data to ads.brainosia.com. One other extension we have analysed sends data here.