Twitch Adblock

AI Security Review

Evidence context: threat category none; evidence quality moderate.

The Twitch Adblock extension declares a single sensitive permission – "tabs" – in manifest.json (finding MANIFEST-SENSITIVE-PERM-TABS). This permission allows the extension to read the URLs of open tabs, which is typical for ad‑blocking tools that need to inspect page content and inject filters. No other high‑risk permissions (e.g., cookies, webRequest, proxy) are present, and there are no declarations that would enable credential harvesting or browser hijacking.

Four network findings indicate that the code makes ordinary web requests: js/tw_old.js:479 and js/tw.js:1 each contain a fetch call, js/bg.js:1 also uses fetch, and js/tw_old.js:219 issues an XMLHttpRequest. The findings do not disclose the target URLs, but the absence of any listed domains suggests that the requests are either to well‑known ad‑filter hosts or to the extension’s own server. No suspicious or non‑generic domains (e.g., obscure tracking or command‑and‑control hosts) appear in the evidence, and no malware‑signature or IoC matches were reported.

The extension’s description explicitly states its purpose – “Deletes Advertisings from Twitch. Enjoy Ads‑Free Twitch.” This functional claim aligns with the observed network activity: ad‑blockers typically retrieve blocklists or update scripts via fetch/XMLHttpRequest. There is no evidence of code obfuscation, bundled malicious payloads, or secret handling; the findings list zero entries for obfuscation, dependency, secret, code‑smell, and tool‑poisoning.

From a security perspective, the primary concern would be the tabs permission combined with remote script loading, which could enable a malicious update if the remote host were compromised. However, the lack of any flagged malicious domains, signatures, or suspicious code patterns strongly suggests the extension functions as intended. The network calls are typical for ad‑blocking extensions that periodically refresh filter lists.

Counterargument: A skeptic might argue that any extension that loads external scripts and holds the tabs permission could be upgraded to deliver malicious code, especially given the anonymous developer email address. While this is a theoretical risk, the current static analysis shows no indicators of malicious intent or capability. No payloads, no command‑and‑control URLs, and no code‑obfuscation are present, which would be expected in a truly malicious extension. Continuous monitoring of updates would be prudent, but based on the available evidence the extension is benign and operates within the normal behavior of ad‑blocking tools.

In conclusion, the extension’s behavior matches its advertised purpose, and there are no concrete signs of malicious activity. Users can consider it a legitimate, though permission‑rich, ad‑blocking utility.

Key Reasons

• Only the 'tabs' permission is declared, which is typical for ad blockers
• Network calls are limited to fetch and XMLHttpRequest without suspicious domains
• No malware signatures, IoCs, or obfuscation were detected
• Findings show no secret handling or code‑smell patterns

Reviewed 2026-05-23; recommended action: no action; model confidence 92%.