Adblock Pro

On install, the extension auto-opens an external third-party landing page at adblock-pro.com without user consent. Combined with the fact that the underlying source is a verbatim repackage of Raymond Hill's uBlock Origin Lite ([email protected], ID cimighlppcgcoapaliogpjjdehbnofhn — both names appear in the code at lines 4150-4151), this strongly suggests a rebranded clone driving traffic/affiliate revenue to a third-party domain that users may mistake for the original ad blocker. Classic clone-extension phishing/monetization vector.

(async function() {      if (e.runtime.onInstalled.addListener((t => {          "install" === t.reason && e.tabs.create({            url: "https://adblock-pro.com/index.html"          });        })), await async function() {            const e = await u("rulesetConfig");

The service worker still contains hardcoded identity checks for the original uBlock Origin Lite ([email protected] / cimighlppcgcoapaliogpjjdehbnofhn) — confirming this `Adblock Pro` extension (kkjokbgfeiakpodabmpoenjokahkidlf) is a verbatim repackage of Raymond Hill's uBOL under a different publisher and brand. While the code itself is the legitimate open-source uBOL (no exfiltration, no remote code load, all `fetch()` calls target bundled extension-local JSON paths), this is a brand/publisher impersonation pattern frequently used by clone extensions to capitalize on a known good codebase while controlling the auto-update channel for later malicious updates.

const q = (() => {    if (t.onRuleMatchedDebug instanceof Object == 0) return !1;    const {      id: n    } = e.runtime;    return "[email protected]" !== n && "ddkjiahejlhfcafbddmgiahcphecmpfh" !== n &&      "cimighlppcgcoapaliogpjjdehbnofhn" !== n;  })(),

The manifest exposes every file in the extension package (`resources: ["*"]`) to every web origin (`matches: ["*://*/*"]`). Any page can probe extension resources via chrome-extension:// URLs, enabling extension fingerprinting/detection and broad attack surface. While `use_dynamic_url` mitigates static ID fingerprinting, the wildcard resource exposure is broader than necessary.

{  "web_accessible_resources": [    {      "resources": [        "*"      ],      "matches": [        "*://*/*"      ],      "use_dynamic_url": true    }  ]}

Content script (injected at document_start into every frame on every URL via the `*://*/*` host permission) reports the host of every page the user visits to the background service worker via `getSiteStatusInRules` and emits a `pageReload` message on every navigation. Functionally this is for per-site filter rule lookup (uBOL pattern), but it gives the extension's background page a complete real-time browsing log of every domain the user visits.

window.onbeforeunload = function() {chrome.runtime.sendMessage({  type: "pageReload"});}, chrome.runtime.onMessage.addListener((function(e) {return "reloadPage" === e.type && location.reload(), !0;})), chrome.runtime.sendMessage({type: "getSiteStatusInRules",host: window.location.host}, (e => {  e && (r = e, function() {    const e = new MutationObserver(i);    e.observe(window.document, {      attributes: !0,      childList: !0,      subtree: !0    }), setTimeout((() => {      e.disconnect();    }), 1e4);  }));}));

Registers a global mousedown listener on every page that captures the DOM target of every right-click (button === 2) and stores it. This is the AdGuard element-picker integration (legitimate when invoked by user via popup), but it runs unconditionally on every page in every frame, recording right-click targets in a closure variable accessible to extension messaging — broader than strictly necessary.

function startHelperForRules() {  chrome.runtime.onMessage.addListener((function(e) {    if ("startHelperForRules" === e.type) {      var s = e.options,        a = s.addRuleCallbackName,        n = null;      t && s.selectElement && (n = t), assistant ? assistant.close() : assistant = adguardAssistant(),        assistant.start(n, (function(t) {          chrome.runtime.sendMessage({            type: a,            ruleText: t          });        }));    }  }));  var t = null;  document.addEventListener("mousedown", (function(e) {    2 === e.button && (t = e.target);  }));}startHelperForRules();