AdGuard AdBlocker

AI Security Review

Evidence context: threat category none; evidence quality moderate.

AdGuard AdBlocker is a widely used content blocker, and the findings in this version (5.5.3.3) match the shape of a large bundled ad-blocking codebase rather than an attack.

Every network finding names a call site, not a destination. pages/popup.js:14728 constructs an XMLHttpRequest, and pages/popup.js:26735 and pages/popup.js:26766 call fetch; that is how the popup loads its own filter status and counters. shared/editor.js:4217 and shared/editor.js:4219 are the custom filter editor reading and validating user rules. filters/local_script_rules.js:3988 and filters/local_script_rules.js:11739 handle scriptlet injection rules, which necessarily parse and fetch rule sets. vendors/xstate.js:678 and vendors/xstate.js:709 come from a bundled state machine library, and vendors/tswebextension.js:32331 is AdGuard's own browser-extension framework. web-accessible-resources/redirects/google-ima3-dai.js:637 is a redirect resource AdGuard ships to intercept Google's IMA ad SDK. Not one of these calls is tied to a suspicious domain, because no endpoint list accompanies them, and the IoC and malware-signature categories are both empty.

The OBFUSCATION-unicode_heavy hits fire on vendors/tswebextension.js, vendors/tsurlfilter.js, shared/editor.js and pages/background.js. These are minified bundles of AdGuard's published TypeScript packages. A filter-syntax parser has to handle non-ASCII domain names, so heavy Unicode in vendors/tsurlfilter.js is a property of what a filter engine does. Minified library output is not obfuscation, and no malware rule fired alongside it.

The OBFUSCATION-invisible_unicode_payload hits are the ones worth reading closely, and they land on filters/filters_i18n.json, _locales/fa/messages.json, and filters/declarative/ruleset_6.json, ruleset_11.json and ruleset_235.json. Persian text uses zero-width joiners and non-joiners as ordinary spelling, which is exactly the documented false positive for locale files. The declarative rulesets hold filter rules that match international domain names, so non-ASCII characters belong there too. The remaining entries, OBFUSCATION-large_base64 in shared/editor.js and pages/background.js and OBFUSCATION-function_indirect in pages/popup.js, are inlined assets and indirect function calls in a bundled UI, with no accompanying payload.

A skeptic would point at two things. The developer name field is empty, which normally raises the anonymous-publisher flag, and an ad blocker that can read and rewrite every page you load is a serious amount of power. Both are fair. They are also answered by what is absent: no credential or cookie access findings, no tool-poisoning findings, no malware signatures, and network calls confined to popup, editor and filter-rule files rather than a background sender with a destination. The extension's own filter data is on disk and readable, which is the opposite of a hidden payload.

The volume here comes from bundle size, not behaviour. A thousand lines of minified filter-parsing code produce a long list of matches without anything in them doing harm.

Key Reasons

• All network findings are fetch/XHR call sites in popup, custom-filter editor, scriptlet-rule and bundled library files, with no suspicious endpoint list and an empty IoC category.
• OBFUSCATION-invisible_unicode_payload fires on _locales/fa/messages.json and internationalised declarative rulesets (ruleset_6, ruleset_11, ruleset_235), the documented zero-width false positive for locale and IDN filter data.
• OBFUSCATION-unicode_heavy fires on minified bundles of AdGuard's own published packages (vendors/tswebextension.js, vendors/tsurlfilter.js), which is bundling, not obfuscation.
• No malware signatures, no credential or cookie access findings, and no tool-poisoning findings across 264 entries.
• AdGuard is an established, identifiable publisher with a public filter-list codebase, so the empty developer_name field in this record reflects missing metadata rather than an anonymous author.

False Positive Considerations

• Minified/bundled library output flagged as OBFUSCATION-unicode_heavy and OBFUSCATION-large_base64 in vendor and background bundles
• Zero-width Unicode in locale and IDN filter files flagged as OBFUSCATION-invisible_unicode_payload
• Network call-site detection firing on legitimate popup, options, editor and scriptlet-rule fetch/XHR usage in an ad blocker
• High total finding count driven by bundle size (239 info-level entries) rather than by malicious behaviour

Reviewed 2026-10-02; recommended action: suppress false positive; model confidence 90%.