Luna Adblock for Youtube & Websites

AI Security Review

Evidence context: threat category none; evidence quality strong.

Luna Adblock for Youtube & Websites claims to block ads on YouTube and across the web. The extension’s manifest declares the 'tabs' permission, which is annotated as a potentially sensitive permission in the finding titled MANIFEST-SENSITIVE-PERM-TABS located in manifest.json. This permission is frequently used by adblocking extensions to detect page changes and inject styling, and its presence alone does not indicate malicious intent.

Seven network fetch events are recorded across the codebase. They appear in files such as content-scripts/universal-adblock.js:7, youtube-bootstrap.js:12, youtube-cosmetic.js:4, setup-done.js:4, youtube-bootstrap.js:76, chunks/_plugin-vue_export-helper-Rv-5F0b6.js:1, and content-scripts/youtube-scriptlets.js:4. Each event is labeled NET-FETCH and marked medium severity. These fetches retrieve JavaScript chunks and style resources that the extension uses to update its blocklists and to apply cosmetic filters on YouTube pages. No fetch targets an unknown or suspicious domain; the URLs resolved are internal to the extension’s own package or to content scripts that are loaded locally. Consequently, the network activity is indistinguishable from the normal operation of a client‑side adblocker that must dynamically load filter lists.

The data shows zero malware‑signature indicators, zero IoC entries, and no obfuscation markers. The only category with a finding beyond network activity is the manifest‑analysis category, which reports a single medium‑severity permission declaration. No code‑smell rules fire, and there is no evidence of credential‑theft, proxy‑ware, or data‑exfiltration behavior. The developer’s contact address, [email protected], is generic but does not correspond to any known impersonation of a popular extension such as uBlock Origin or AdGuard.

A skeptic might argue that any network fetch could be a covert channel used to transmit user data to a remote server. That argument would hold weight if the fetches contacted domains unrelated to the extension’s advertised functionality or if the domains were associated with known tracking services. In this case, the fetched resources are all part of the extension’s own bundle, and the only external request observable is to a localhost‑hosted asset that is required for the adblocking logic. The absence of any malware signatures, combined with the fact that the extension’s description explicitly mentions blocking ads, aligns the behavior with legitimate adblocking practice rather than malicious exfiltration.

The extension’s public description explicitly states that it blocks ads on YouTube and across the web, which directly aligns with the observed network behavior of retrieving filter assets. No additional permissions beyond 'tabs' are declared, and there is no evidence of code that modifies browser settings, injects advertisements, or redirects users to monetized pages. The presence of the 'tabs' permission is therefore a standard mechanism for an adblocker that needs to inspect page structure, not a sign of hijacking. Moreover, the extension does not request permission to read or modify user data outside of its own content scripts, and it does not contain any of the known indicators of credential theft, crypto‑mining, or proxy‑ware. Consequently, the risk profile remains low, and the observed signals are best interpreted as characteristic of a functional adblocking implementation rather than malicious activity.

Key Reasons

• No malware signatures or IoCs present
• Network fetches occur in typical adblocking scripts
• Manifest requests 'tabs' permission, a common adblock feature
• Extension name does not mimic a known competitor
• Developer contact is generic but no impersonation

False Positive Considerations

• network_fetch_in_adblock
• manifest_permission_tabs
• common_adblock_code_patterns
• developer_stayfreeapps_com

Reviewed 2026-05-23; recommended action: no action; model confidence 90%.