← All reportsPublic report

gorhill/ublock

uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean.

67k stars JavaScript View on GitHubprofiled 11d ago
Try GitZoid
110PRs this week
2Contributors
91Deps scanned
4Issues found
01 · Repo overview

How ublock is put together

uBlock Origin is a wide-spectrum browser content blocker implemented as a cross-browser WebExtension (Manifest V2) for Chromium, Firefox, Opera, Edge, and Thunderbird, written almost entirely in vanilla JavaScript ES modules with no runtime framework. The architecture centers on an event-driven background page (src/js/background.js, start.js) that hosts the static network filtering engine, cosmetic/scriptlet filtering, dynamic rule evaluation, and a redirect engine; content scripts injected into pages communicate with it over a long-lived browser.runtime port abstraction (vAPI.messaging). A vAPI compatibility layer (platform/common plus per-platform *_ext.js overrides) normalizes differences between browsers, while filter lists are fetched as remote assets and compiled into efficient trie-based structures (hntrie.js, biditrie.js). Build tooling (Makefile, tools/*.sh, tools/*.py, platform/mv3) assembles per-browser packages and generates MV3 rulesets; npm is used only for dev-time linting.

Languages

JavaScriptPythonShellCSSHTML

Frameworks

WebExtension APIs (browser/chrome namespace)CodeMirror (editor CSS/assets in src/css)Node.js (build/dev tooling)

Datastores

browser.storage.local (settings, rules, cached assets)browser.storage.session (in-memory mirror)CacheStorage / IndexedDB-backed cache (src/js/cachestorage.js)localStorage (via background-mediated vAPI.localStorage)

Infrastructure

Browser extension packages built per-platform (Chromium, Firefox, Opera, Thunderbird, MV3)GitHub Releases distributionCrowdin for translationsnpm-published core package @gorhill/ubo-core

Major components

vAPI platform abstraction layer

Normalizes browser extension APIs (tabs, networking, storage, privacy settings, messaging) across Chromium/Firefox via platform/common/vapi-*.js extended by platform/chromium/vapi-background-ext.js and platform/firefox/vapi-background-ext.js.

Static network filtering engine

Parses and compiles EasyList-syntax filters (extended with uBO syntax) into trie/bidi-trie structures and matches requests in src/js/static-net-filtering.js, hntrie.js, biditrie.js.

Cosmetic and scriptlet filtering

Hides DOM elements and injects procedural filters/scriptlets using src/js/cosmetic-filtering.js, scriptlet-filtering.js, and contentscript.js, including HTML and HTTP-header filtering modules.

Dynamic filtering and rules

Evaluates user-defined dynamic firewall rules (per-site allow/block/noop matrices) in src/js/dynamic-net-filtering.js, hnswitches.js, and persists them via dyna-rules UI.

Asset and list management

Fetches, caches, updates, and serializes remote filter lists and redirect resources through src/js/assets.js, storage.js, diff-updater.js, and assets/assets.json.

Background orchestration

Wires tab lifecycle, page stores, traffic interception (webRequest), logger, commands, and startup sequencing in src/js/background.js, start.js, tab.js, pagestore.js, traffic.js.

UI surfaces

Dashboard, popup, element picker, logger, and support pages under src/*.html with matching src/js/* controllers and src/css/* stylesheets.

Build and packaging tooling

Per-browser packaging scripts (tools/make-*.sh, make-*-meta.py), MV3 ruleset generation (platform/mv3/make-rulesets.js), and the npm core package under platform/npm.

Over the past five weeks the uBlock Origin project shipped a steady stream of security and quality fixes to its content-blocking 'scriptlets' (small scripts that neutralize ads), alongside ongoing polish of the newer Manifest V3 (mv3) browser extension. A notable theme was hardening trusted scriptlets so untrusted filter lists can't abuse them, plus improvements to clipboard-protection and other utility scriptlets. Routine work like automated dev-build updates, translation imports from Crowdin, and changelog updates continued throughout.

Week by week

2026-08-17A security fix kept untrusted sources from injecting trusted scriptlets, while the mv3 build got performance and backup/restore improvements.latest6 changes

Fix

Blocked untrusted injection of trusted scriptlets

Closed a loophole where filter lists without special trust could inject scriptlets that require elevated trust.

Feature

New Brave-detection token for filters

Added an `env_brave` preparser token so filters can behave differently in the Brave browser.

Refactor

Faster large-list imports on mv3

Fixed a slowdown that occurred when importing very large filter lists into the Manifest V3 version.

Fix

Fixed mv3 backup/restore glitches

Restored missing settings during backup/restore and fixed the Filter Lists panel not rendering correctly after a reset or restore.

Chore

Removed legacy stylesheet capability

Dropped support for the outdated `cap_user_stylesheet` mechanism.

Chore

Swapped Korean filter list source

Replaced the List-KR blocklist with the filterslists-KO alternative.

2026-08-10New filtering powers arrived this week, including cookie manipulation and a way to target content inside HTML template tags.6 changes

Feature

Cookie set/unset/given values support

Added the ability for filters to set, unset, or check specific cookie values (#3936).

Feature

New `content(...)` procedural operator

Filters can now look up elements hidden inside `<template>` tags on a page.

Fix

Improved clipboard-write protection

Refined the scriptlet that stops websites from silently writing to your clipboard (worked on twice this week).

Fix

Safer popup blocking on mv3

Popup-blocking rules now respect excluded origins and the `to=` option when converted for Manifest V3.

Feature

Broad scriptlet exceptions on mv3

Added support for the `#@#js()` exception syntax so entire scriptlets can be disabled where needed.

Fix

Regression fix

Patched a problem introduced by an earlier change (commit 505fbc7a75).

2026-08-03The week centered on releasing a new stable version, publishing a self-hosted Chromium package, and fixing mv3 list-management issues.6 changes

Chore

New stable release

Cut a new stable version of the extension with an updated changelog.

Chore

Self-hosted CRX package published

Started distributing the Chromium package directly after fixing its download URL.

Fix

Fixed imported-lists display on mv3

The 'Imported lists' section now updates properly when lists change.

Fix

Better removeParams rules on mv3

URL-stripping rules were patched to carry main_frame and initiatorDomains properties correctly (done twice).

Feature

Permission warning for sandbox filters

The mv3 build now warns users that sandbox-based filters require the 'user scripts' permission.

Refactor

Improved json-edit and scriptlet internals

Enhanced the `json-edit` scriptlet and reworked how scriptlets receive extra arguments.

2026-07-27A quieter week focused on small refinements, including better clipboard protection and a fix ensuring enabled filter rules actually apply on mv3.5 changes

Fix

Enabled rulesets no longer skipped on mv3

Fixed a bug where some enabled filter rule sets were unintentionally not applied in the Manifest V3 build.

Fix

Improved prevent-clipboard-write scriptlet

Continued refining the scriptlet that blocks websites from writing to your clipboard.

Feature

excludeMatches accepts multiple values

The excludeMatches setting can now take several values at once instead of just one.

Docs

Documentation link added on mv3

Added a link to documentation within the Manifest V3 interface.

Chore

Translation updates

Imported community translations from Crowdin multiple times during the week.

2026-07-20Work spanned a release candidate, compatibility with older Chromium versions, and improvements to logging and scriptlet utilities.6 changes

Chore

Release candidate prepared

Created new revisions for a release candidate along with changelog updates.

Fix

Kept older Chromium support

Maintained compatibility with Chromium 109 and earlier versions.

Feature

Stock lists movable to imported lists on mv3

Users of the Manifest V3 build can now move built-in filter lists into their imported list group.

Fix

Logger preserves whitespace

The request logger no longer strips whitespace characters from entries.

Docs

Documentation for trusted-click-element

Added reference documentation for the `trusted-click-element` scriptlet.

Refactor

Improved proxy-apply utility

Enhanced the `proxy-apply` scriptlet and clarified it as a weak dependency of its config counterpart.

03 · Security check

Dependencies and code review

91 dependencies scanned

Dependency advisories

Security Watch

4 vulnerable packages (10 advisories) across 91 scanned dependencies.

warninghigh · npmfixed in 5.0.7

brace-expansion 1.1.12

3 advisories. Fixed in 5.0.7.

How it can be abusedThis library expands patterns like file globs and is only pulled in by npm development tools such as the linter used when building this project; it never runs inside the shipped browser extension. A developer who lints a repository containing attacker-crafted filenames or paths could hang or crash their build machine with memory exhaustion, but extension users are not affected.

  • highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
  • highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
  • highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
warninghigh · npmfixed in 3.4.0

flatted 3.3.3

2 advisories. Fixed in 3.4.0.

How it can be abusedAn attacker who can feed crafted data into flatted's parse function could crash the process or tamper with object prototypes, but in this repo the package is only used by developer build and lint tooling, never shipped to users, so only a developer running compromised build scripts could be affected.

warninghigh · npmfixed in 3.15.0

js-yaml 4.1.0

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker who can influence YAML files parsed during development or packaging, such as filter-list metadata or build configuration, could craft deeply nested merge keys that make the parser burn CPU for minutes on one small file, stalling builds. This only affects people building uBlock Origin from source, not the extension's end users, because js-yaml never runs inside the browser.

  • highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
  • highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
warninghigh · npmfixed in 10.2.3

minimatch 3.1.2

3 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker could craft a file path or pattern that makes minimatch freeze the process while it tries to match it, but here minimatch is only used by build and lint scripts on developer machines, never inside the extension itself. Only developers running those tools with attacker-controlled input (for example a malicious repo or filename) would be affected; end users of uBlock Origin are not exposed.

  • highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
  • highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
  • highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

Code review

No concrete code-level issues confirmed.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required