uBlock Origin Lite

AI Security Review

Evidence context: threat category none; evidence quality strong.

uBlock Origin Lite is a content blocker developed by Raymond Hill, the same developer behind the original uBlock Origin. The extension's package contains filter rule sets organized by language and region, such as rulesets/scripting/scriptlet/main/easyprivacy.js, rulesets/scripting/scriptlet/main/chn-0.js, and rulesets/scripting/scriptlet/main/fra-0.js. These files implement the blocking logic that prevents ads, trackers, and other unwanted content from loading in the browser.

The 60 network findings all originate from these scriptlet files. Each finding title follows the pattern NET-XMLHTTPREQUEST-rulesets/scripting/scriptlet/main/... or NET-FETCH-rulesets/scripting/scriptlet/main/.... These are not outbound connections to suspicious servers. Scriptlets in content blockers use XMLHttpRequest and fetch calls to intercept and neutralize network requests made by web pages. A scriptlet in easyprivacy.js at line 992 blocking a tracking request will trigger a network finding because the scanner sees a fetch call in the source code. This is the mechanism by which the extension does its job.

The 8 obfuscation findings break down into two groups. Seven are OBFUSCATION-INVISIBLE_ZERO_WIDTH matches in locale files like _locales/te/messages.json (Telugu), _locales/si/messages.json (Sinhala), _locales/ml/messages.json (Malayalam), and _locales/fa/messages.json (Farsi). These writing systems use zero-width joiner and zero-width non-joiner characters as legitimate parts of their orthography. The scanner flags them because it cannot distinguish between steganographic use and normal text composition. The same rule fires on rulesets/scripting/specific/irn-0.json and rulesets/scripting/specific/deu-0.json, which contain filter rules with characters from Persian and German respectively. The eighth obfuscation finding, OBFUSCATION-FROMCHARCODE_BULK at rulesets/scripting/scriptlet/main/spa-1.js:3001, matches a String.fromCharCode call used to construct DOM manipulation strings dynamically. This is standard practice in ad blocker scriptlets, which build CSS selectors and HTML snippets at runtime.

No malware signatures matched. No indicators of compromise pointed to external command-and-control infrastructure. No credential access patterns appeared. The extension declares no host permissions and no special permissions beyond what Manifest V3 requires for content blocking.

A skeptic might point to the 7 high-severity obfuscation findings and argue that invisible characters hidden across multiple files indicate deliberate code concealment. But the files in question are locale translations and regional filter lists. Telugu, Sinhala, Malayalam, and Farsi scripts require zero-width characters for correct rendering. The scanner's zero-width detector does not account for writing system requirements, which is why it fires on every localized extension that supports South Asian or Middle Eastern languages. The fromCharCode match in the Spanish scriptlet file is equally mundane. Ad blocker scriptlets construct blocking rules as strings, and String.fromCharCode is one of several ways to assemble those strings. None of these findings represent hidden payloads or covert channels.

With 21 million users and a developer identity tied to one of the most scrutinized open-source projects in the browser extension ecosystem, uBlock Origin Lite operates exactly as expected. Every finding in this scan traces back to the mechanics of content blocking or the requirements of multilingual text.

Key Reasons

• Extension is uBlock Origin Lite by Raymond Hill, a verified open-source developer with 21 million users
• All 60 network findings are XMLHttpRequest and fetch calls inside content blocking scriptlet files
• Zero-width obfuscation findings are legitimate characters in South Asian and Middle Eastern locale files
• No malware signatures, no indicators of compromise, and no credential access patterns detected
• Extension declares no special permissions consistent with a Manifest V3 content blocker

False Positive Considerations

• Zero-width characters in locale files for Telugu, Sinhala, Malayalam, and Farsi scripts are legitimate orthographic characters
• NET-XMLHTTPREQUEST and NET-FETCH findings in scriptlet files are the mechanism by which content blockers intercept page requests
• String.fromCharCode in scriptlet files is used for dynamic DOM rule construction, not payload encoding

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 95%.