Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: AdBlock Shield

CRITICAL RISKRemoved from Chrome Web Store

AdBlock Shield

ID: ljfcfconehlpojiodgopbcefmkfmfabd

Could be malicious

Supported Languages

🇧🇷Brazilian Portuguese

🇳🇱Dutch

🇺🇸English

🇫🇷French

🇩🇪German

🇮🇹Italian

🇪🇸Spanish

🇸🇪Swedish

Extension Info & Metadata

Status

Removed

Version

1.0.0.8

Size

0.15 MB

Rating

5.0/5

Reviews

Users

325,646

Type

Extension

Updated

Jun 6, 2021

Publisher Contextual Analysis

Author: Pop-up BlockerView Profile
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

325,646

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Blocks advertising, trackers and popups

AdBlock Shield is light, fast and gets rid of thousands of ads ! Features: ⭐ Pop-block - we block popup ads from thousands of sources and close them automatically ⭐ AdBlock - we block ads from more than 12'000 sources ⭐ Social Privacy - We block social trackers : Facebook, Twitter, Linkedin, Pinterest, Reddit, TikTok ⭐ Analytics Privacy - We block the analytics : Google Analytics, Hotjar, MouseFlow, FreshMarketer, Luckyorange, Stats WP plugin ⭐ Stealth - we prevent websites from detecting our extension We do not block video ads on Youtube ✓ Permissions: we need default permissions on every website to remove ads ⓘ About We were not satisfied with the other extensions out there so we decided to create our own blocking engine. It is free to download and use !

User Growth

No data available

No user growth data available for this extension

Rating Count

No data available

No rating count data available for this extension

Average Rating

No data available

No rating data available for this extension

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical4

High2

Medium5

Low0

Versions scanned

Showing 2 of 2 scanned versions with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
1.0.0.8 Code review	5
1.0.0.6 Code review	6

Extension Version	Code Review Findings
1.0.0.8	5
1.0.0.6	6

Files with findings

1 distinct path — top paths by unique finding count:

bg.js11

S.No.	Category	Severity	File	Summary	Found in Version
1	Code Injection	critical	bg.js (line 23)	This code builds JavaScript from values stored in `chrome.storage.local` and injects it into pages with `chrome.tabs.executeScript`. Because those storage values are later updated from a remote server, this creates a …	1.0.0.8
2	Remote Code Loading	critical	bg.js (line 81)	The extension contacts `getpopupblocker.com` and blindly writes the server's JSON response into local extension storage. In combination with the storage-backed `executeScript` logic, this is an effective remote update…	1.0.0.8
3	Remote Code Loading	critical	bg.js (line 23)	The `scriptLocal()` function reads ALL keys from `chrome.storage.local` and assembles them into a raw JavaScript string that is injected into the active tab via `chrome.tabs.executeScript({ code: scriptFull })`. The s…	1.0.0.6
4	Remote Code Loading	critical	bg.js (line 94)	The `updateBlockList()` function fetches JSON from a remote server and blindly stores the entire parsed response object into `chrome.storage.local` with no validation or sanitization. Any key in the server response — …	1.0.0.6
5	Privilege Escalation	high	bg.js (line 116)	On installation, the extension enumerates all open browser tabs and forcibly closes any tab pointing to the Chrome Web Store or Microsoft Edge Add-ons extension detail pages. This deliberately prevents users from read…	1.0.0.6
6	Tracking	high	bg.js (line 77)	On first run the extension registers a unique user ID with an external server at `getpopupblocker.com`, transmitting the extension runtime ID. On subsequent runs it phones home with the persistent UID, version, blocke…	1.0.0.6
7	Code Injection	medium	bg.js (line 139)	The `basescript()` function initializes the local script payload with inline JavaScript strings that are later injected into pages by `scriptLocal()`. These strings are seeded locally on install/update but are fully o…	1.0.0.6
8	Other	medium	bg.js (line 127)	On install, the extension enumerates all windows and forcibly closes Chrome Web Store and Edge Add-ons listing pages. That behavior is not required for ad blocking and can interfere with user review, troubleshooting, …	1.0.0.8
9	Tracking	medium	bg.js (line 81)	This code creates a persistent `uid` and periodically sends it to a remote server alongside extension version, blocked-ad counts, warning counts, and part of the extension ID. That is tracking/telemetry collection unr…	1.0.0.8
10	Tracking	medium	bg.js (line 165)	The uninstall URL embeds a unique identifier and local usage metric (`blockedads`) into a remote request triggered when the user removes the extension. This is a tracking pattern that lets the operator correlate unins…	1.0.0.8
11	Tracking	medium	bg.js (line 147)	The uninstall URL encodes the persistent user UID and blocked-ad count, transmitting them to the remote server when the user uninstalls. Combined with the install-time UID registration and recurring stats beacons, thi…	1.0.0.6

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
getpopupblocker.com	/privacy.htm	https://getpopupblocker.com/privacy.htm
fonts.googleapis.com	/css2	https://fonts.googleapis.com/css2?family=Overpass:wght@100;300;400;700&display=swap
www.google.	-	https://www.google.
www.youtube.com	-	https://www.youtube.com
getpopupblocker.com	/jsondata.php	https://getpopupblocker.com/jsondata.php?a=uid&extid=
getpopupblocker.com	/jsondata.php	https://getpopupblocker.com/jsondata.php?a=stats&uid=
chrome.google.com	/webstore/detail/	https://chrome.google.com/webstore/detail/

Showing 1 to 10 of 20 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


1.0.0.8	IPv4	-
35.153.211.213	IPv4	-
35.227.234.222	IPv4	-

5.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

It works well, easy to install. Highly recommended!

Claire Mahjoub·26 May 2021

Easy to install and quite effective, too! Thanks for sparing me all those annoying ads. ^_^

Line Arias·25 May 2021

Love this!!!!!

Silverio Tolitol·25 May 2021

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Code Diff

Compare extension code between any two versions.

0 changed files detected

No comparable text files found between these versions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

AdBlock Shield

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 2 Versions11

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating