Spotify Ad Blocker - Blockify Remote Configuration and Uninstall Tracking

Overview

Spotify Ad Blocker - Blockify is a Chrome extension with approximately 400,000 users. It does what it says—blocks ads on Spotify and YouTube—but it also includes behaviors that go beyond typical user expectations. The extension periodically fetches a remote JSON configuration file from the developer's CDN and uses it to control whether ad-blocking content scripts are injected into pages. Additionally, it sets a custom uninstall URL that includes a unique user identifier and the extension version, enabling tracking of uninstall events.

No overtly malicious payload was observed in the current code, but the remote configuration mechanism exposes users to silent changes by whoever controls the server, and the uninstall tracking raises privacy concerns.

How it works

The extension's background script (bk_modules.js) contains several functions. First, it calls setSwitches() to fetch a remote JSON configuration from https://blockify.b-cdn.net/switches190.json every time the extension starts (bk_modules.js:353-356). The fetched JSON contains switches that determine whether content scripts are registered.

Based on these switches, the extension registers content scripts on YouTube and Spotify using chrome.scripting.registerContentScripts() (bk_modules.js:412-419). For example, when the YouTube switch is enabled, it registers a script with id: YT_SCRIPT_ID, js: ['inject_yt_blocking_script.js'], matching *://*.youtube.com/*, running at document_start in the MAIN world and all frames. This means the extension can turn its ad-blocking functionality on or off remotely without updating the extension itself.

Payload

The remote configuration file is the primary control mechanism. Its contents are not visible in the static code, but the fetch call indicates the server can change the switches at any time. If the CDN is compromised or the developer chooses to modify the configuration, the extension could theoretically disable ad blocking, enable additional scripts, or alter behavior without user consent. However, the sandbox run output was truncated, so we could not confirm the actual network request or the contents of the configuration file.

In addition, the extension sets an uninstall URL using chrome.runtime.setUninstallURL() (bk_modules.js:345-348) to https://getblockify.com/feedback/?d=${Number(date)}&u=${uuid}&v=${chrome.runtime.getManifest().version}. This URL includes a unique identifier (uuid) generated for each installation, allowing the developer to track which users uninstall the extension and when. This is a silent tracking mechanism that many users may not be aware of.

Store status

The extension is currently active on the Chrome Web Store. No evidence of a store removal or vendor response was provided in the analysis. Users who are uncomfortable with remote configuration control or uninstall tracking should remove the extension. If they have used the extension, they may want to review the permissions granted (such as access to YouTube and Spotify data) and consider whether any sensitive data could have been exposed through the extension's actions. The extension's permission to run content scripts on YouTube and Spotify means it could potentially read or modify page content, though no malicious activity was observed in the current code.