Block ADS App

The service worker attaches a webRequest.onResponseStarted listener scoped to all URLs (*://*/*) and requests the responseHeaders extra-info spec, giving the extension access to every HTTP response header across all browsing activity. The handler delegates to core.onResponseStarted in core.min.js, which is absent from the extracted bundle, making it impossible to determine how this data is used. This pattern is commonly used to harvest authentication cookies, session tokens, and tracking identifiers from response headers.

"use strict";import * as core from "/lib/js/core.min.js";chrome.alarms.onAlarm.addListener(core.onAlarm), chrome.runtime.onInstalled.addListener(core.initialization), chrome.runtime.onStartup.addListener(core.initialization), chrome.tabs.onRemoved.addListener(core.onRemoved), chrome.webRequest.onResponseStarted.addListener(core.onResponseStarted, {  urls: ["*://*/*"]}, {  "responseHeaders"}), chrome.tabs.onUpdated.addListener(core.onUpdated);

The service worker statically imports all of its business logic from /lib/js/core.min.js, which is confirmed by verified_contents.json to exist in the published extension (hash rz9gJc4QHXJdpQoeFCbBk5JIXjuzYrzJEubEYfnam0) but is absent from the extracted analysis bundle. Every handler — onResponseStarted, onAlarm, onUpdated, onRemoved, and initialization — is defined there, meaning the entire behavioural surface of the extension is opaque. The missing file, together with similarly absent default_popup.min.js and options_page.min.js, suggests deliberate obfuscation to prevent static analysis of the extension's true functionality.

"use strict";import * as core from "/lib/js/core.min.js";chrome.alarms.onAlarm.addListener(core.onAlarm), chrome.runtime.onInstalled.addListener(core.initialization), chrome.runtime.onStartup.addListener(core.initialization), chrome.tabs.onRemoved.addListener(core.onRemoved), chrome.webRequest.onResponseStarted.addListener(core.onResponseStarted, {  urls: ["*://*/*"]}, {  "responseHeaders"}), chrome.tabs.onUpdated.addListener(core.onUpdated);

The only enabled declarativeNetRequest ruleset (system.json) contains zero blocking rules — every rule has action type allowAllRequests, which whitelists traffic rather than blocking it. All legitimate filter lists (easylist, easyprivacy, fanboy-annoyance, malicious) are declared in the manifest but are disabled by default. An extension that markets itself as an ad blocker but ships with no blocking rules active is a strong indicator of a fraudulent extension using the ad-blocker premise as a social-engineering cover for its real functionality.

[  {    "id": 1,    "priority": 1,    "condition": {      "urlFilter": "|chrome-extension",      "resourceTypes": [        "main_frame"      ]    },    "action": {      "type": "allowAllRequests"    }  },  {    "id": 2,    "priority": 1,    "condition": {      "urlFilter": "|chrome-error:",      "resourceTypes": [        "main_frame"      ]    },    "action": {      "type": "allowAllRequests"    }  },  {    "id": 3,    "priority": 1,    "condition": {      "urlFilter": "|chrome:",      "resourceTypes": [        "main_frame"      ]    },    "action": {      "type": "allowAllRequests"    }  },  {    "id": 4,    "priority": 1,    "condition": {      "urlFilter": "|about:",      "resourceTypes": [        "main_frame"      ]    },    "action": {      "type": "allowAllRequests"    }  }]

The combination of scripting permission, activeTab, and *://*/* host access allows the extension to programmatically inject arbitrary JavaScript into any page at any time. Paired with the webRequest listener that captures all response headers, this creates a complete capability set for session hijacking, credential harvesting, and content manipulation across the entire browser. The extension being unlisted yet having 5,000 users further indicates covert distribution outside the normal Web Store discovery path.

{  "permissions": [    "alarms",    "storage",    "webRequest",    "activeTab",    "scripting",    "declarativeNetRequest",    "declarativeNetRequestFeedback"  ],  "host_permissions": [    "*://*/*"  ],  "web_accessible_resources": [    {      "resources": [        "/lib/html/*"      ],      "matches": [        "*://*/*"      ]    }  ]}