What our analysis found

uBlock Origin Lite, used by 21,000,000 people, showed no malicious code in Extension Auditor's review. Its permissions mean it can read and change data on all websites and can inject scripts into pages. It comes from a trusted publisher and was last updated in September 2026.

uBlock Origin Lite is a well-known, open-source (GPL v3) MV3 content blocker by Raymond Hill (gorhill), one of the most trusted names in browser privacy tooling. The source code reviewed in is entirely focused on managing declarativeNetRequest rulesets, per-site filtering modes, and internal extension messaging with strict origin checking (sender.origin!== UBOL_ORIGIN guard at line 405). The web_accessible_resources are stub replacements for ad and tracking SDKs ( returns a random browserId and empty arrays; is a bare IIFE) — this is the canonical anti-fingerprinting technique used by ad blockers, not malicious fingerprinting. The ML model was driven by high JS file count, large total size, and regex hits that all derive from the multilingual filter rule scriptlets bundled for ~50 languages, not from any data-exfiltration logic. The bundled manifest has two additional permissions not listed in the published manifest summary (offscreen and userScripts), which is consistent with the extension having been updated 1 day ago while the CWS-provided listing data lags behind — both permissions are expected and necessary for MV3 content filtering. Third-party risk likelihood score of and Google trusted+featured publisher status directly contradict the ML verdict.