Pie Adblock - A Powerful Free Ad Blocker

AI Security Review

Evidence context: threat category none; evidence quality strong.

Pie Adblock is a legitimate ad blocking extension with 2 million users on Chrome. The extension's findings are consistent with normal ad blocker functionality and do not indicate malicious behavior.

The 345 network findings are all NET-JQUERY_AJAX detections from files in the assets/tac/ directory, including site-specific scripts like jossandmain.js, boohooman-nl.js, prettylittlething-au.js, worldmarket.js, westerndigital.js, farfetch-ca.js, hp.js, and coles-au.js. These are expected behaviors for an ad blocker that includes site-specific rules and scripts to handle different e-commerce and retail websites. Ad blockers commonly make network requests to fetch blocklists, update rules, or interact with site-specific configurations. None of these findings reference suspicious domains—only legitimate retail and e-commerce sites.

The single manifest finding (MANIFEST-SENSITIVE-PERM-TABS in manifest.json) is standard for ad blockers, which require tabs permission to inject scripts and block ads on web pages. This is not a security concern when the extension's stated purpose is ad blocking.

Critically, there are zero malware signatures, zero IoC (indicators of compromise) domains, and zero code-smell findings. The 2 obfuscation findings are minimal and do not indicate malicious intent. The developer email [email protected] is a legitimate professional address, and the extension name "Pie Adblock" is a known ad blocker brand, not a typosquatting attempt.

A skeptic might argue that 345 network findings is concerning. However, the nature of these findings matters more than the count. All 345 are jquery_ajax calls from legitimate-looking site-specific files, not requests to suspicious domains. The XIOC extractor's tendency to flag any network activity as a finding means high counts alone are meaningless without specific malicious domains. This extension has no requests to query., search., or other hijacking-related domains, and no evidence of data exfiltration to unknown servers.

The extension has 2 million users, indicating widespread adoption and trust. The findings are driven by legitimate ad blocker functionality being flagged by automated scanners that do not distinguish between benign network activity and malicious behavior.

Key Reasons

• Zero malware signatures and zero suspicious IoC domains
• All 345 network findings are jquery_ajax calls to legitimate retail sites
• Tabs permission is standard for ad blockers
• 2 million users indicates widespread trust
• Developer email [email protected] is legitimate

False Positive Considerations

• Site-specific ad blocker scripts triggering network findings
• XIOC extractor flagging benign jquery_ajax calls
• Tabs permission flagged as sensitive but standard for ad blockers

Reviewed 2026-05-23; recommended action: suppress false positive; model confidence 85%.