[ new scan ] [ statistics ] [ github ] [ twitter ] [ help ]

AdGuard AdBlocker

Version 5.2.800.27 View in Chrome Web Store

Last scanned: about 9 hours ago

Extension Details

Developer: Adguard Software Limited

Rating: 4.7 ★ (66.7K ratings)

Users: 16,000,000

Context-Aware Verdict

MEDIUM

Overall Risk

Trust Factors: AdGuard is a well-established cybersecurity company with a strong reputation in the ad-blocking industry. The extension has an impressive 16 million users and maintains a high 4.7-star rating from over 66,000 reviews, indicating broad user satisfaction and trust. The company has been operating in the privacy and security space for many years, building credibility through consistent service delivery.

Concerns: While the security scanner flagged this as "Critical" risk, the permissions are actually necessary and appropriate for an ad blocker's core functionality. The webRequest, webNavigation, and declarativeNetRequest permissions are essential for intercepting and blocking ads and trackers. The tabs permission allows the extension to work across browser tabs, while cookies permission helps block tracking cookies. The broad host permissions (<all_urls>) are required since ads appear on virtually all websites. However, these permissions do create a powerful combination that could theoretically be misused.

Recommendations: Given AdGuard's established reputation and the functional necessity of these permissions for ad blocking, the risk is manageable for most users. The extension is operating as expected for its category. Users concerned about the extensive permissions could consider running it in a separate Chrome profile for additional isolation, though this may be unnecessary given the company's track record. Regular monitoring of the extension's behavior and keeping it updated is advisable.

Findings

HIGH

Broad Host Permissions

This extension has broad host permissions allowing it to access many or all websites. This could potentially be used to steal sensitive data or track browsing activity.

HIGH

High-Risk Permission: cookies

This extension has the cookies permission. Can access and modify browser cookies. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: tabs

This extension has the tabs permission. Can access browser tab information and manipulate tabs. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webNavigation

This extension has the webNavigation permission. Can track your web navigation. This could potentially be used maliciously to compromise security or privacy.

HIGH

High-Risk Permission: webRequest

This extension has the webRequest permission. Can intercept and modify web requests. This could potentially be used maliciously to compromise security or privacy.

MEDIUM

Medium-Risk Permission: contextMenus

This extension has the contextMenus permission. Can add items to the context menu.

MEDIUM

Medium-Risk Permission: storage

This extension has the storage permission. Can store data locally.

MEDIUM

Medium-Risk Permission: unlimitedStorage

This extension has the unlimitedStorage permission. Can store unlimited data locally.

Security Analysis Details

Required Permissions:

tabs
webRequest
webNavigation
storage
unlimitedStorage
contextMenus
cookies
declarativeNetRequest
declarativeNetRequestFeedback
scripting
userScripts

Optional Permissions:

privacy

Host Permissions:

<all_urls>

Content Security Policy:

extension_pages: script-src 'self'; object-src 'self'

Embedded URLs (32775 total):

https://www.youtube.com/watch?v=cPF4iBedoF0&feature=youtu.be&t=1307	https://github.com/mridgway/hoist-non-react-statics/blob/master/src/index.js
https://github.com/facebook/fbjs/blob/c69904a511b900266935168223063dd8772dfc40/packages/fbjs/src/core/shallowEqual.js	https://github.com/mobxjs/mobx-react/issues?utf8=%E2%9C%93&q=is%3Aissue+label%3Aobservable-props-or-not+
https://github.com/AdguardTeam/AdguardBrowserExtension	http://www.gnu.org/licenses/
https://github.com/AdguardTeam/FiltersRegistry/blob/4528f7ae6b38aec90111a27efb0a7e0958d0cf37/tags/metadata.json#L40	https://developer.chrome.com/docs/extensions/reference/api/userScripts
https://developer.chrome.com/docs/extensions/reference/api/userScripts#chrome_versions_prior_to_138_developer_mode_toggle	https://developer.chrome.com/docs/extensions/reference/api/userScripts#chrome_versions_138_and_newer_allow_user_scripts_toggle
https://link.adtidy.org/forward.html	https://ace.c9.io/api/classes/src_editor.Editor.html#setValue
http://www.w3.org/2000/svg	https://www.w3.org/WAI/ARIA/apg/patterns/combobox/examples/combobox-select-only/
https://caniuse.com/mdn-api_beforeunloadevent_returnvalue	https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2712
https://tc39.es/ecma262/#sec-isarray	https://bugs.chromium.org/p/v8/issues/detail?id=12681
https://tc39.es/ecma262/#sec-array.prototype.push	https://bugs.chromium.org/p/v8/issues/detail?id=14222
https://github.com/whatwg/url/pull/734	http://www.unicode.org/reports/tr35/tr35-31/tr35-dates.html#Date_Format_tokens
https://github.com/date-fns/date-fns/blob/master/docs/unicodeTokens.md	https://github.com/date-fns/tz
https://github.com/date-fns/utc	https://github.com/date-fns/date-fns/issues/3638#issuecomment-1877082874
https://www.unicode.org/reports/tr35/tr35-dates.html#Date_Field_Symbol_Table	https://date-fns.org/docs/getISOWeekYear
https://date-fns.org/docs/getWeekYear	http://en.wikipedia.org/wiki/ISO_week_date
https://en.wikipedia.org/wiki/Week#The_ISO_week_date_system	https://date-fns.org/docs/toDate
http://es5.github.io/#x15.9.1.1	https://github.com/kossnocorp
https://github.com/leshakoss	https://github.com/jashkenas/underscore/pull/1247
https://bugs.chromium.org/p/v8/issues/detail?id=90	https://css-tricks.com/debouncing-throttling-explained-examples/
https://bugzilla.mozilla.org/show_bug.cgi?id=1414602	https://bugzilla.mozilla.org/show_bug.cgi?id=1023984
https://github.com/HTTPArchive/wappalyzer/blob/main/src/technologies/r.json	https://github.com/remix-run/react-router/issues/10579
https://reactrouter.com/v6/routers/picking-a-router.	https://github.com/remix-run/remix/issues/927
https://github.com/AdguardTeam/ExtendedCss#homepage	https://semver.org/lang/ru/
https://developer.mozilla.org/ru/docs/Web/API/NavigatorLanguage/languages	https://github.com/AdguardTeam/AdguardBrowserExtension/issues/2117
https://github.com/remix-run/react-router/issues/12250	https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Function/bind#Polyfill
https://github.com/progers/pathseg	https://lists.w3.org/Archives/Public/www-svg/2015Jun/0044.html
http://www.w3.org/TR/SVG11/single-page.html#paths-InterfaceSVGPathSeg	http://www.w3.org/TR/SVG11/single-page.html#paths-Interfacewindow.SVGPathElement.
https://www.w3.org/TR/SVG11/single-page.html#paths-__svg__SVGPathElement__getPathSegAtLength	http://www.w3.org/TR/SVG11/single-page.html#paths-InterfaceSVGPathSegList
http://www.w3.org/TR/SVG11/single-page.html#paths-InterfaceSVGAnimatedPathData	http://www.w3.org/TR/SVG11/single-page.html#paths-PathDataBNF
http://jedwatson.github.io/classnames	http://www.opensource.org/licenses/mit-license.php
http://www.w3.org/1999/xhtml	http://www.w3.org/1999/xlink
http://www.w3.org/XML/1998/namespace	http://www.w3.org/2000/xmlns/
https://faisalman.github.io/ua-parser-js	https://github.com/faisalman/ua-parser-js
http://mozilla.org/MPL/2.0/.	https://github.com/mozilla/webextension-polyfill/issues/130
https://stately.ai/docs/input	https://rxjs.dev
https://stately.ai/docs/transitions#event-objects	https://cataas.com/cat/says/
https://example.com/...	https://github.com/microsoft/TypeScript/issues/23182#issuecomment-379091887
https://github.com/microsoft/TypeScript/pull/57673	https://www.w3.org/TR/scxml/#SCXMLEventProcessor
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/globalThis	https://stately.ai/docs/persistence
https://www.w3.org/TR/scxml/#microstepProcedure	https://github.com/statelyai/rfcs/pull/4

Page 1 of 410

Raw Manifest

{
  "name": "__MSG_name__",
  "icons": {
    "16": "assets/icons/on-16.png",
    "128": "assets/icons/on-128.png"
  },
  "action": {
    "default_icon": {
      "19": "assets/icons/on-19.png",
      "38": "assets/icons/on-38.png"
    },
    "default_popup": "pages/popup.html",
    "default_title": "__MSG_name__"
  },
  "author": "Adguard Software Ltd",
  "version": "5.2.800.27",
  "background": {
    "service_worker": "pages/background.js"
  },
  "short_name": "__MSG_short_name__",
  "update_url": "https://clients2.google.com/service/update2/crx",
  "description": "__MSG_description__",
  "permissions": [
    "tabs",
    "webRequest",
    "webNavigation",
    "storage",
    "unlimitedStorage",
    "contextMenus",
    "cookies",
    "declarativeNetRequest",
    "declarativeNetRequestFeedback",
    "scripting",
    "userScripts"
  ],
  "options_page": "pages/options.html",
  "devtools_page": "pages/devtools.html",
  "default_locale": "en",
  "content_scripts": [
    {
      "js": [
        "pages/content-script-start.js"
      ],
      "run_at": "document_start",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "pages/content-script-end.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": true
    },
    {
      "js": [
        "pages/subscribe.js"
      ],
      "run_at": "document_end",
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "all_frames": true,
      "match_about_blank": false
    },
    {
      "js": [
        "pages/thankyou.js"
      ],
      "run_at": "document_start",
      "matches": [
        "*://*.adguard.com/*/thankyou.html*",
        "*://*.adguard.info/*/thankyou.html*",
        "*://*.adguard.app/*/thankyou.html*"
      ],
      "all_frames": false
    }
  ],
  "host_permissions": [
    "<all_urls>"
  ],
  "manifest_version": 3,
  "optional_permissions": [
    "privacy"
  ],
  "minimum_chrome_version": "121",
  "content_security_policy": {
    "extension_pages": "script-src 'self'; object-src 'self'"
  },
  "declarative_net_request": {
    "rule_resources": [
      {
        "id": "ruleset_0",
        "path": "filters/declarative/ruleset_0/ruleset_0.json",
        "enabled": false
      },
      {
        "id": "ruleset_1",
        "path": "filters/declarative/ruleset_1/ruleset_1.json",
        "enabled": false
      },
      {
        "id": "ruleset_10",
        "path": "filters/declarative/ruleset_10/ruleset_10.json",
        "enabled": false
      },
      {
        "id": "ruleset_103",
        "path": "filters/declarative/ruleset_103/ruleset_103.json",
        "enabled": false
      },
      {
        "id": "ruleset_105",
        "path": "filters/declarative/ruleset_105/ruleset_105.json",
        "enabled": false
      },
      {
        "id": "ruleset_108",
        "path": "filters/declarative/ruleset_108/ruleset_108.json",
        "enabled": false
      },
      {
        "id": "ruleset_109",
        "path": "filters/declarative/ruleset_109/ruleset_109.json",
        "enabled": false
      },
      {
        "id": "ruleset_11",
        "path": "filters/declarative/ruleset_11/ruleset_11.json",
        "enabled": false
      },
      {
        "id": "ruleset_110",
        "path": "filters/declarative/ruleset_110/ruleset_110.json",
        "enabled": false
      },
      {
        "id": "ruleset_111",
        "path": "filters/declarative/ruleset_111/ruleset_111.json",
        "enabled": false
      },
      {
        "id": "ruleset_112",
        "path": "filters/declarative/ruleset_112/ruleset_112.json",
        "enabled": false
      },
      {
        "id": "ruleset_120",
        "path": "filters/declarative/ruleset_120/ruleset_120.json",
        "enabled": false
      },
      {
        "id": "ruleset_13",
        "path": "filters/declarative/ruleset_13/ruleset_13.json",
        "enabled": false
      },
      {
        "id": "ruleset_16",
        "path": "filters/declarative/ruleset_16/ruleset_16.json",
        "enabled": false
      },
      {
        "id": "ruleset_17",
        "path": "filters/declarative/ruleset_17/ruleset_17.json",
        "enabled": false
      },
      {
        "id": "ruleset_18",
        "path": "filters/declarative/ruleset_18/ruleset_18.json",
        "enabled": false
      },
      {
        "id": "ruleset_19",
        "path": "filters/declarative/ruleset_19/ruleset_19.json",
        "enabled": false
      },
      {
        "id": "ruleset_2",
        "path": "filters/declarative/ruleset_2/ruleset_2.json",
        "enabled": true
      },
      {
        "id": "ruleset_20",
        "path": "filters/declarative/ruleset_20/ruleset_20.json",
        "enabled": false
      },
      {
        "id": "ruleset_202",
        "path": "filters/declarative/ruleset_202/ruleset_202.json",
        "enabled": false
      },
      {
        "id": "ruleset_203",
        "path": "filters/declarative/ruleset_203/ruleset_203.json",
        "enabled": false
      },
      {
        "id": "ruleset_208",
        "path": "filters/declarative/ruleset_208/ruleset_208.json",
        "enabled": false
      },
      {
        "id": "ruleset_21",
        "path": "filters/declarative/ruleset_21/ruleset_21.json",
        "enabled": false
      },
      {
        "id": "ruleset_214",
        "path": "filters/declarative/ruleset_214/ruleset_214.json",
        "enabled": false
      },
      {
        "id": "ruleset_216",
        "path": "filters/declarative/ruleset_216/ruleset_216.json",
        "enabled": false
      },
      {
        "id": "ruleset_217",
        "path": "filters/declarative/ruleset_217/ruleset_217.json",
        "enabled": false
      },
      {
        "id": "ruleset_218",
        "path": "filters/declarative/ruleset_218/ruleset_218.json",
        "enabled": false
      },
      {
        "id": "ruleset_22",
        "path": "filters/declarative/ruleset_22/ruleset_22.json",
        "enabled": false
      },
      {
        "id": "ruleset_224",
        "path": "filters/declarative/ruleset_224/ruleset_224.json",
        "enabled": false
      },
      {
        "id": "ruleset_227",
        "path": "filters/declarative/ruleset_227/ruleset_227.json",
        "enabled": false
      },
      {
        "id": "ruleset_23",
        "path": "filters/declarative/ruleset_23/ruleset_23.json",
        "enabled": false
      },
      {
        "id": "ruleset_233",
        "path": "filters/declarative/ruleset_233/ruleset_233.json",
        "enabled": false
      },
      {
        "id": "ruleset_235",
        "path": "filters/declarative/ruleset_235/ruleset_235.json",
        "enabled": false
      },
      {
        "id": "ruleset_238",
        "path": "filters/declarative/ruleset_238/ruleset_238.json",
        "enabled": false
      },
      {
        "id": "ruleset_243",
        "path": "filters/declarative/ruleset_243/ruleset_243.json",
        "enabled": false
      },
      {
        "id": "ruleset_249",
        "path": "filters/declarative/ruleset_249/ruleset_249.json",
        "enabled": false
      },
      {
        "id": "ruleset_252",
        "path": "filters/declarative/ruleset_252/ruleset_252.json",
        "enabled": false
      },
      {
        "id": "ruleset_253",
        "path": "filters/declarative/ruleset_253/ruleset_253.json",
        "enabled": false
      },
      {
        "id": "ruleset_254",
        "path": "filters/declarative/ruleset_254/ruleset_254.json",
        "enabled": false
      },
      {
        "id": "ruleset_255",
        "path": "filters/declarative/ruleset_255/ruleset_255.json",
        "enabled": false
      },
      {
        "id": "ruleset_256",
        "path": "filters/declarative/ruleset_256/ruleset_256.json",
        "enabled": false
      },
      {
        "id": "ruleset_257",
        "path": "filters/declarative/ruleset_257/ruleset_257.json",
        "enabled": false
      },
      {
        "id": "ruleset_259",
        "path": "filters/declarative/ruleset_259/ruleset_259.json",
        "enabled": false
      },
      {
        "id": "ruleset_3",
        "path": "filters/declarative/ruleset_3/ruleset_3.json",
        "enabled": false
      },
      {
        "id": "ruleset_4",
        "path": "filters/declarative/ruleset_4/ruleset_4.json",
        "enabled": false
      },
      {
        "id": "ruleset_5",
        "path": "filters/declarative/ruleset_5/ruleset_5.json",
        "enabled": false
      },
      {
        "id": "ruleset_6",
        "path": "filters/declarative/ruleset_6/ruleset_6.json",
        "enabled": false
      },
      {
        "id": "ruleset_7",
        "path": "filters/declarative/ruleset_7/ruleset_7.json",
        "enabled": false
      },
      {
        "id": "ruleset_8",
        "path": "filters/declarative/ruleset_8/ruleset_8.json",
        "enabled": false
      },
      {
        "id": "ruleset_9",
        "path": "filters/declarative/ruleset_9/ruleset_9.json",
        "enabled": false
      }
    ]
  },
  "web_accessible_resources": [
    {
      "matches": [
        "http://*/*",
        "https://*/*"
      ],
      "resources": [
        "web-accessible-resources/*"
      ],
      "use_dynamic_url": true
    }
  ]
}

by ✦ Astarte

AdGuard AdBlocker

Extension Details

Context-Aware Verdict

Findings

Security Analysis Details

Required Permissions:

Optional Permissions:

Host Permissions:

Content Security Policy:

Embedded URLs (32775 total):

Raw Manifest

Detections

Manifest Findings