| 1 | Data Exfiltration | critical | adblock-datacollection.v2.js (line 180) | An hourly scheduler assembles a detailed browser fingerprint payload including the addon name/version, platform, application version, user locale, all subscribed filter lists, every domain visited (with page counts), … | |
| 2 | Privilege Escalation | critical | adblock-adreport.js (line 277) | After requesting the optional 'management' permission from the user (under the guise of an ad-report troubleshooting step), the extension enumerates ALL installed extensions with chrome.management.getAll() and then ca… | |
| 3 | Code Injection | high | adblock-uiscripts-load_jquery_ui.js (line 16) | The load_jquery_ui function fetches arbitrary file content from the background page via BGcall('readfile', ...) and executes it directly with eval(result) in the content-script context. The developer comment 'suck it,… | |
| 4 | Code Injection | high | include.preload.js (line 504) | The content script injects code into iframe contentWindow objects by calling contentWindow.eval() with a dynamically constructed string containing a function serialization. This pattern bypasses the same-origin policy… | |
| 5 | Tracking | high | adblock-stats.js (line 80) | The extension silently generates a persistent unique user ID on first install and stores it in two redundant locations (chrome.storage and localStorage) to survive clearing either one individually. This ID is attached… | |
| 6 | Unauthorized Data Collection | high | adblock-datacollection.v2.js (line 84) | The extension installs a webRequest listener on all main-frame navigation events to record every domain the user visits, along with page-visit counts, into an in-memory cache. A second listener (handleTabUpdated) dyna… | |
| 7 | Unauthorized Data Collection | high | adblock-adreport.js (line 584) | The extension collects the full list of all installed extensions (name, ID, version, type, enabled status) into a reportData object and then calls sendData(), which would transmit the payload to https://getadblock.com… | |
| 8 | Unauthorized Data Collection | high | adblock-datacollection.v2.js (line 75) | This code records every top-level HTTP/HTTPS page's domain into an internal cache and increments per-domain visit counts. Given the extension's all-sites visibility, this creates a browsing-history telemetry dataset b… | |
| 9 | Obfuscation | medium | adblock-ytchannel.js (line 24) | A hardcoded YouTube Data API v3 key is obfuscated using base64 encoding via atob() (decodes to AIzaSyC2J0nenhIgO7jfZQF0iWZ7pJwwl0W3uIs). For every YouTube page load, the extension makes an XHR call to Google's API usi… | |
| 10 | Other | medium | adblock-notificationoverlay.js (line 93) | The overlay content script installs a window.postMessage listener that explicitly does not verify the event.sender origin. Any web page running in the browser can send a message with the value 'removethe_ABoverlay' to… | |
| 11 | Tracking | medium | adblock-stats.js (line 81) | The extension generates and persists a stable per-install `userid` in two storage locations. A durable identifier like this is primarily useful for telemetry or tracking across sessions; the later network send paths a… | |
| 12 | Tracking | medium | adblock-bandaids.js (line 377) | When the user visits `getadblock.com`, the content script reads the extension's internal `userid` and injects it into the page DOM as a hidden element. That exposes an extension-scoped identifier to first-party page s… | |
| 13 | Unauthorized Data Collection | medium | adblock-bandaids.js (line 446) | When a user visits pornhub.com, the content script silently writes a cookie (FastPopSessionRequestNumber) and localStorage/sessionStorage values that alter the site's pop-up behavior. Writing cookies and storage value… | |
| 14 | Unauthorized Data Collection | medium | adblock-datacollection.v2.js (line 196) | The extension prepares an hourly telemetry push and hands the accumulated dataset to `postFilterStatsToLogServer()`. Earlier in the same file, that `data` object is populated with subscribed filter lists, locale, per-… | |
| 15 | Network Interception | low | ext/background.js (line 555) | The background page installs a blocking `webRequest` hook over `<all_urls>` and can cancel any matching request. That capability is expected for an ad blocker, but it is still a sensitive interception primitive that w… | |
| 16 | Obfuscation | low | adblock-ytchannel.js (line 21) | This script derives the current YouTube channel or video identifier from the visited page and sends it to the YouTube Data API using an API key obscured with `atob()`. It is not overtly malicious, but it is an obfusca… | |
