The extension is a straightforward blocker. fetches a blocklist from the publisher's own public GitHub repo () and builds declarativeNetRequest rules — this is the extension's stated core function, not a covert channel. The only outbound redirect destination is [domain withheld] (publisher's own domain), used to show a 'blocked' page. uses innerHTML solely to substitute chrome.i18n.getMessage() values into trusted __MSG_*__ template slots in the extension's own popup — not user-supplied input and not injection into any external page. The ML score is 0.00 and chrome-stats impact is, both corroborating a clean verdict; the permission-based risk score of 3.50 reflects broad permissions that are functionally necessary for any ad blocker, not evidence of malice.