Top Risks

• js_external_hosts includes ad-tech/affiliate domains (ad4game.com, advertserve.com, cpmnetwork.adbooth.com, affplaybook.com) — severe conflict of interest for an adblocker.
• webRequest + scripting + <all_urls> with no CSP gives full capability to intercept and modify all web traffic.
• Privacy policy discloses data collection and third-party sharing, but extension communicates with ad/monetization infrastructure.
• No developer name listed; verified publisher status provides limited assurance given monetization host fingerprint.
• 12 distinct external JS hosts including torrents.to, demo.dynamicoxygen.com, test.gluk.name — anomalous for a popup blocker.

Evidence

• ad_tech_external_hosts crx js_external_hosts includes ad4game.com, advertserve.com, cpmnetwork.adbooth.com, affplaybook.com — monetization/ad-tech domains in an adblocker.
• no_csp manifest content_security_policy is null (MV3, so no MV2 penalty, but absence noted alongside broad host access).
• broad_host_permissions manifest host_permissions and content_scripts_matches both declare <all_urls> combined with webRequest and scripting.
• privacy_policy_third_party_sharing api Privacy policy fetched; scope_extension=true, data_collection=true, third_party_sharing=true, retention=true.
• no_developer_name store developer_name is empty string; identity relies solely on email hello@popup-blocker.org and verified_publisher flag.
• verified_publisher store verified_publisher=true; discount capped per v3.5(E) because monetization_hits check applies to fingerprint external hosts.
• anomalous_external_hosts crx 12 external hosts including torrents.to, test.gluk.name, mirodex.blogspot.co.il — unrelated to popup blocking function.
• geo_diversity crx host_geo_diversity: 3 countries (CA, IN, US) — below +1.5 threshold of >=4.

Permissions Breakdown

• webRequest high Can observe and intercept all HTTP requests across all URLs.
• <all_urls> (host_permissions) high Broad host access paired with webRequest and scripting amplifies risk.
• scripting high Can inject arbitrary scripts into any page visited by the user.
• declarativeNetRequest medium Can block/redirect network requests; core to stated popup-blocking function.
• tabs medium Can read tab URLs and metadata across all open tabs.
• storage low Local settings persistence; low standalone risk.
• contextMenus low Adds right-click menu items; minimal risk.

Pillar Scores

Bookkeeping