Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AdBlock Plus - Always Free

CRITICAL RISKRemoved from Chrome Web Store

AdBlock Plus - Always Free

ID: oaokpcjkmfmacfdnhmimangelmdpkgmf

Could be malicious

Supported Languages

🇺🇸English

Extension Info & Metadata

Status

Removed

Version

1.0.0.2

Size

2.02 MB

Rating

4.8/5

Reviews

Users

10,000

Type

Extension

Updated

Mar 9, 2024

Publisher Contextual Analysis

Author: brainerkevin728View Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

10,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Blocking ads and pop-ups on YouTube, Facebook, Twitch, and your favorite websites has never been easier.

Instantly block annoying ads, pop-ups, and intrusive trackers with AdBlock Plus - Always Free. AdBlock Plus - Always Free is the only tool you need to take full control of your web browsing experience. Eliminate unwanted ads, intrusive notifications, and advertising trackers within a few clicks. Key benefits include: Block Unwanted Ads & Trackers Enjoy a peaceful internet experience without any limitations by removing unwanted ads and trackers. Disable Annoying Notifications Instantly disable browser push notifications and interruptions with our 'Pop-Up Blocker' feature. Regain control today and fully manage your web browsing experience completely free of charge to disable unwanted ads, intrusive trackers, and annoying notifications. AdBlock Plus - Always Free will not store or log your data; your privacy is our priority. With the Facebook and YouTube ad-blocking feature, there may be instances where the feature doesn't work if developers change the source code and functionality. We cannot guarantee certainty, but we always strive to ensure functionality and provide you with the best experience using Facebook and YouTube. When using the Facebook ad-blocking feature, we will check if you are logged in to perform the ad-checking process and remove annoying ads. This ensures the utility works smoothly without conflicting with default activities.

User Growth

Showing data from Jan 23, 2024 to Oct 21, 2024

Versions

-50%(-10,000 users)

Compared to 5 months ago

3 versions released in this period

Rating Count

Total: 58 ratings

Average Rating

Current: 4.78 / 5.0+4.78

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High3

Medium1

Low0

Versions scanned

Showing 1 of 3 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.1 Code review	9

Extension Version	Code Review Findings
1.0.0.1	9

Files with findings

4 distinct paths — top paths by unique finding count:

service_worker/background.bundle.js4
static/content_scripts/main.js3
manifest.json1
pages/popup.html1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	service_worker/background.bundle.js (line 141)	setCk/getCK forward caller-controlled arguments straight into chrome.cookies.set/get with no domain, name, or origin validation. Combined with onMessageExternal exposure to facebook.com and youtube.com, this lets thos…	1.0.0.1
2	Network Interception	critical	service_worker/background.bundle.js (line 66)	The 'fetch' handler accepts caller-supplied URL, headers, params, method and body, then disables the extension's own declarativeNetRequest 'block_ads' ruleset before issuing the request and re-enables it afterward. Th…	1.0.0.1
3	Network Interception	critical	service_worker/background.bundle.js (line 160)	updateRule wipes existing dynamic rules and installs caller-supplied action/condition pairs verbatim, with no schema validation or origin check. Because this handler is reachable via onMessageExternal, externally_conn…	1.0.0.1
4	Privilege Escalation	critical	service_worker/background.bundle.js (line 28)	The service worker registers onMessageExternal alongside onMessage and routes both into the same dispatcher, exposing a generic command surface (fetch, get/setCk, get/setDataToStorage, updateRule) to externally_connec…	1.0.0.1
5	Remote Code Loading	critical	static/content_scripts/main.js (line 8369)	The content script POSTs to Facebook's internal /api/graphql/ endpoint with a hardcoded fb_dtsg CSRF token, jazoest, lsd, and a numeric doc_id, then takes the response's `rule` field and pipes it directly into the bac…	1.0.0.1
6	Privilege Escalation	high	manifest.json (line 79)	The manifest grants broad host permissions and the cookies permission, then explicitly opens onMessageExternal to facebook.com and youtube.com pages. With the background.js handlers for `fetch`, `getCK`/`setCk`, and `…	1.0.0.1
7	Remote Code Loading	high	static/content_scripts/main.js (line 16907)	The Firebase configuration is base64-obfuscated and decoded with atob/JSON.parse at runtime — pointing at an attacker-controlled Realtime Database (adblock-6478e-default-rtdb.firebaseio.com) that the extension subscri…	1.0.0.1
8	Unauthorized Data Collection	high	static/content_scripts/main.js (line 8612)	On Facebook pages, the content script asks the background to read the `c_user` cookie via the chrome.cookies API. `c_user` is Facebook's logged-in user-ID cookie; reading it through the cookie API specifically (rather…	1.0.0.1
9	Credential Theft	medium	pages/popup.html (line 35)	The popup loads otplib (a TOTP/HOTP one-time-password library) from a `scripts/` folder also exposed via web_accessible_resources. An ad blocker has no legitimate need for OTP/2FA generation code; bundling it alongsid…	1.0.0.1

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


https:	-	https://api-secure.solvemedia.com^D��~G
r.i.ua	/s	http://r.i.ua/s?&p&lswordmaster.org�d��eF
https:	-	https://www.unieuro.itl��C
https:	-	https://a.pr-cy.ru^��B
http:	-	http://a.pr-cy.ru^��B
https:	-	https://�w��p=
http:	-	http://Dw��o=
https:	-	https://r.i.ua^��j:
http:	-	http://r.i.ua^$��i:
http:	-	http://x.o2.pl^

Showing 1 to 10 of 40 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


77.91.202.130	IPv4	-
127.0.0.1	IPv4	-
78.46.19.203	IPv4	-
109.169.66.161	IPv4	-
180.76.2.18	IPv4	-
212.95.32.75	IPv4	-
193.197.158.209	IPv4	-
111.90.150.149	IPv4	-
111.90.150.10	IPv4	-
111.90.159.132	IPv4	-
199.116.177.156	IPv4	-
120.132.57.41	IPv4	-
216.18.176.4	IPv4	-
192.168.1.1	IPv4	-
192.168.0.1	IPv4	-
173.249.49.204	IPv4	-
0.0.0.1	IPv4	-
5.61.55.143	IPv4	-
51.77.227.99	IPv4	-
51.77.227.98	IPv4	-
51.77.227.97	IPv4	-
51.77.227.96	IPv4	-
5.188.62.157	IPv4	-
37.1.213.100	IPv4	-
37.1.209.213	IPv4	-
35.226.75.50	IPv4	-
23.109.87.42	IPv4	-
146.190.12.4	IPv4	-
91.241.60.117	IPv4	-
51.89.187.143	IPv4	-
51.89.187.142	IPv4	-
51.89.187.141	IPv4	-
51.89.187.140	IPv4	-
51.89.187.139	IPv4	-
51.89.187.138	IPv4	-
51.89.187.137	IPv4	-
51.89.187.136	IPv4	-
51.77.227.103	IPv4	-
51.77.227.102	IPv4	-
51.77.227.101	IPv4	-
51.77.227.100	IPv4	-
45.32.105.134	IPv4	-
35.239.57.233	IPv4	-
35.194.26.233	IPv4	-
23.109.87.101	IPv4	-
167.99.31.227	IPv4	-
162.252.214.4	IPv4	-
159.203.84.58	IPv4	-
77.162.125.199	IPv4	-
35.238.205.163	IPv4	-
35.232.188.118	IPv4	-
35.224.227.218	IPv4	-
203.195.121.11	IPv4	-
185.193.38.148	IPv4	-
167.206.10.148	IPv4	-
185.165.169.108	IPv4	-
104.197.199.227	IPv4	-
1.0.0.2	IPv4	-

Showing 1 to 58 of 60 rows

Rows per page:

4.2 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Facebook stopped working at all.

СП

Стефан Пеев·23 Jul 2024

It blocked facebook and no whitelist can be added.

Tony Chan·23 Jul 2024

(DISCLAIMER) - I am STILL giving this incredible company (and excellent app) FIVE STARS for ALL of the incredible years that they have provided BLOCKED ADS successfully. ** Recently in JUNE (2024) Youtube came up with an Anti-consumer practice by blackmailing YOU into turning off AdBlock by restricting your access - My response? If AdBlock comes up with a NEW (and fully functional product that completely bypass ALL Youtube Ads) I WILL SUBSCRIBE AND SUPPORT. (I am completely grateful to AdBlock for SAVING ME from all those BS advertisements - especially "financial gurus" that promises you the entire world if you sign up for their courses, the reason why i will ALWAYS be against YT is because **** I have reported a particular SCAM broadcaster at least a hundred times - they were never banned, STILL showing their SCAM advertisements, and Youtube expect customers to not be angry?)

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

AdBlock Plus - Always Free

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 3 Versions9

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating