AdBlocker Ultimate

AI Security Review

Evidence context: threat category none; evidence quality moderate.

This extension, 'AdBlocker Ultimate' by AdAvoid Ltd, presents a classic false-positive profile common to ad-blocking extensions. The 516 malware signatures (high severity) are almost certainly triggered by embedded filter rules and blocklists, not actual malware. This is confirmed by the absence of any suspicious IoCs (0 domains flagged), which would be present if the extension were exfiltrating data or communicating with malicious infrastructure.

The network findings show only generic fetch calls in pages/assistant.js:4981 and vendors/tswebextension.js:33812. These are normal HTTP requests for any extension that needs to update filter lists or communicate with its own servers. There are no custom search engine domains, no third-party tracking endpoints, and no data exfiltration destinations in the IoC findings.

The 5 obfuscation findings are likely from minified JavaScript bundles (common in webpack/esbuild output) or zero-width characters in locale files like _locales/he/messages.json and _locales/en/messages.json, which are legitimate false positives per the CVEQ documentation. The metadata findings reference standard extension files: assets/images/lock-icon.svg, filters/declarative/ruleset_14/ruleset_14.json, and various locale message files—all expected for a localized ad blocker.

The extension has 0 users, which is concerning for a production release but does not indicate malice. Combined with an unknown developer ('AdAvoid Ltd'), this warrants monitoring, but the absence of malicious behavioral indicators (no credential access patterns, no browser hijacking, no suspicious network destinations) supports a false-positive verdict.

Counterargument: A skeptic might argue that 516 malware signatures with 0 users and an unknown developer indicates a newly uploaded malicious extension. However, malware signatures without supporting IoCs or code-smell findings are well-documented false positives for ad blockers. The filter rules in filters/declarative/ruleset_14/ruleset_14.json contain thousands of blocked domains that trigger signature rules. If this were actual malware, we would expect to see suspicious network destinations in the IoC findings, which are absent here. The verdict remains likely_false_positive because the evidence shows benign ad-blocking behavior, not malicious activity.

Key Reasons

• 516 malware signatures with 0 IoCs indicates filter list false positives, not actual malware
• Network findings show only generic fetch calls with no suspicious destinations
• Obfuscation findings likely from minified JS and locale files (known FP patterns)
• Metadata files are standard extension assets (images, locales, filter rules)
• Ad blockers commonly trigger high signature counts from embedded blocklists

False Positive Considerations

• Bundled filter lists triggering malware signatures
• Minified JavaScript flagged as obfuscation
• Generic fetch calls detected as network findings
• Locale files with Unicode characters flagged as obfuscation

Reviewed 2026-04-27; recommended action: suppress false positive; model confidence 75%.