Is Telegram Blur - Advanced Telegram Web Privacy safe?

Medium risk

Telegram Blur - Advanced Telegram Web Privacy contacts ads.brainosia.com from an all-sites content script.

The extension registers an ad-related content script on every website and fetches https://ads.brainosia.com/data.json when that script loads. This request is separate from the Telegram blur feature and can send normal browser request metadata to the ad server as users browse arbitrary sites.

45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Telegram Blur fetches an ad server on every website, not only Telegram

Telegram Blur runs a content script on every website you visit, not only Telegram.

On page load it automatically requests an ad list from ads.brainosia.com.

We observed this fire on three unrelated non-Telegram sites in testing.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You open any website, not just Telegram.

Telegram Blur's content script matches every page ("<all_urls>").

The extension did this

The extension automatically requests an ad list from ads.brainosia.com.

The request fires as soon as the page loads, before you touch the extension's UI.

What each ad-server request exposes
  • Page you're on
    https://www.wikipedia.org/

    The site making the request, visible to ads.brainosia.com as the request's origin.

  • Your IP address
    203.0.113.42

    Your network address is visible to the ad server on every one of these requests.

  • Browser details
    Mozilla/5.0 (Windows NT 10.0; Win64; x64)

    Standard request headers such as User-Agent travel with the request.

The code that does this

The ad fetch runs unconditionally on every page

Readable version
// Runs on EVERY page, because manifest.json matches this script to "<all_urls>",// not just https://web.telegram.org/*let ads = [];console.log("LOG : ", window.location.href); // logs the current page URL to the console// Fetches an ad/affiliate list from a third-party ad server.// No user action, no consent prompt, fires on every page load.fetch("https://ads.brainosia.com/data.json?v=" + Math.random())  .then((response) => {    if (!response.ok) {      throw new Error("Failed to fetch ads");    }    return response.json();  })  .then((response) => {    ads = response; // holds the returned ad objects (each has a "link") in memory    if (ads.length > 2) {      console.log(ads);      console.log("LOG :", ads[ads.length - 1].link);    }    if (!Array.isArray(ads) || ads.length === 0) {      console.warn("No ads available");    }  })  .catch((error) => {    console.error("Error fetching ads:", error);  });// Waits for a message (from the extension's own popup) naming one of the ad// links above, then shows a confirmation dialog before opening it in a tab.chrome.runtime.onMessage.addListener((request, sender, sendResponse) => {  if (request.type === "confirm-redirect" && request.url) {    let urls = ads.map((el) => el.link);    if (urls.includes(request.url)) {      alertify        .confirm(          request.interstitial ? "Advertisement" : "Are you sure?",          request.interstitial            ? `<div style="text-align: center;">      <img src="${request.interstitial}" style="max-width: 100%; max-height: 250px; border-radius: 8px;">      <p>Check out this ad</p>    </div>`            : `Do you want to visit this URL?<br><br>     <div style="background: #f5f5f5; padding: 10px; border-radius: 4px;">       ${request.url}     </div>`,          function () {            window.open(request.url, "_blank"); // opens the ad link in a new tab          },          function () {            // Cancel          }        )        .set({ labels: { ok: "Open", cancel: "Cancel" } });    }  }});
Captured request
GEThttps://ads.brainosia.com/data.json?v=0.7291834650192837

200 OK, JSON array of ad objects, each with a link field pointing to affiliate/ad destinations such as whop.com/toolsuite/buy-vip.

Where the data goes
    • ads.brainosia.com

    Receives your page context, IP address, and browser headers on every website you visit, and returns affiliate ad links such as whop.com/toolsuite/buy-vip.

What it can do

Permissions this extension asks for, as declared in version 3.1.0. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on web.telegram.org

    https://web.telegram.org/

  • Store data in your browser

    storage

  • Run its own code inside the pages you visit

    scripting

Where it sends data

Destinations our analysis observed Telegram Blur - Advanced Telegram Web Privacy contacting. Sending data somewhere is not a finding on its own - an extension that syncs your settings has to talk to its own server - but it is where your data can go, and who else it goes to.

  • ads.brainosia.com

    Telegram Blur - Advanced Telegram Web Privacy sends data to ads.brainosia.com. One other extension we have analysed sends data here.

Updated 21 September 2026jlkmjnjncpcplnajcbibddpkmbficecj