gorhill/ublock
uBlock Origin - An efficient blocker for Chromium and Firefox. Fast and lean.
How ublock is put together
uBlock Origin is a wide-spectrum browser content blocker implemented as a cross-browser WebExtension (Manifest V2) for Chromium, Firefox, Opera, Edge, and Thunderbird, written almost entirely in vanilla JavaScript ES modules with no runtime framework. The architecture centers on an event-driven background page (src/js/background.js, start.js) that hosts the static network filtering engine, cosmetic/scriptlet filtering, dynamic rule evaluation, and a redirect engine; content scripts injected into pages communicate with it over a long-lived browser.runtime port abstraction (vAPI.messaging). A vAPI compatibility layer (platform/common plus per-platform *_ext.js overrides) normalizes differences between browsers, while filter lists are fetched as remote assets and compiled into efficient trie-based structures (hntrie.js, biditrie.js). Build tooling (Makefile, tools/*.sh, tools/*.py, platform/mv3) assembles per-browser packages and generates MV3 rulesets; npm is used only for dev-time linting.
Languages
Frameworks
Datastores
Infrastructure
Major components
vAPI platform abstraction layer
Normalizes browser extension APIs (tabs, networking, storage, privacy settings, messaging) across Chromium/Firefox via platform/common/vapi-*.js extended by platform/chromium/vapi-background-ext.js and platform/firefox/vapi-background-ext.js.
Static network filtering engine
Parses and compiles EasyList-syntax filters (extended with uBO syntax) into trie/bidi-trie structures and matches requests in src/js/static-net-filtering.js, hntrie.js, biditrie.js.
Cosmetic and scriptlet filtering
Hides DOM elements and injects procedural filters/scriptlets using src/js/cosmetic-filtering.js, scriptlet-filtering.js, and contentscript.js, including HTML and HTTP-header filtering modules.
Dynamic filtering and rules
Evaluates user-defined dynamic firewall rules (per-site allow/block/noop matrices) in src/js/dynamic-net-filtering.js, hnswitches.js, and persists them via dyna-rules UI.
Asset and list management
Fetches, caches, updates, and serializes remote filter lists and redirect resources through src/js/assets.js, storage.js, diff-updater.js, and assets/assets.json.
Background orchestration
Wires tab lifecycle, page stores, traffic interception (webRequest), logger, commands, and startup sequencing in src/js/background.js, start.js, tab.js, pagestore.js, traffic.js.
UI surfaces
Dashboard, popup, element picker, logger, and support pages under src/*.html with matching src/js/* controllers and src/css/* stylesheets.
Build and packaging tooling
Per-browser packaging scripts (tools/make-*.sh, make-*-meta.py), MV3 ruleset generation (platform/mv3/make-rulesets.js), and the npm core package under platform/npm.
A security fix kept untrusted sources from injecting trusted scriptlets, while the mv3 build got performance and backup/restore improvements.
5 weeksWeek of 2026-08-17
Week of 2026-08-17latest
A security fix kept untrusted sources from injecting trusted scriptlets, while the mv3 build got performance and backup/restore improvements.
Week of 2026-08-10
New filtering powers arrived this week, including cookie manipulation and a way to target content inside HTML template tags.
Week of 2026-08-03
The week centered on releasing a new stable version, publishing a self-hosted Chromium package, and fixing mv3 list-management issues.
Week of 2026-07-27
A quieter week focused on small refinements, including better clipboard protection and a fix ensuring enabled filter rules actually apply on mv3.
Week of 2026-07-20
Work spanned a release candidate, compatibility with older Chromium versions, and improvements to logging and scriptlet utilities.
Over the past five weeks the uBlock Origin project shipped a steady stream of security and quality fixes to its content-blocking 'scriptlets' (small scripts that neutralize ads), alongside ongoing polish of the newer Manifest V3 (mv3) browser extension. A notable theme was hardening trusted scriptlets so untrusted filter lists can't abuse them, plus improvements to clipboard-protection and other utility scriptlets. Routine work like automated dev-build updates, translation imports from Crowdin, and changelog updates continued throughout.
Week by week
2026-08-17A security fix kept untrusted sources from injecting trusted scriptlets, while the mv3 build got performance and backup/restore improvements.latest6 changes
Fix
Blocked untrusted injection of trusted scriptlets
Closed a loophole where filter lists without special trust could inject scriptlets that require elevated trust.
Feature
New Brave-detection token for filters
Added an `env_brave` preparser token so filters can behave differently in the Brave browser.
Refactor
Faster large-list imports on mv3
Fixed a slowdown that occurred when importing very large filter lists into the Manifest V3 version.
Fix
Fixed mv3 backup/restore glitches
Restored missing settings during backup/restore and fixed the Filter Lists panel not rendering correctly after a reset or restore.
Chore
Removed legacy stylesheet capability
Dropped support for the outdated `cap_user_stylesheet` mechanism.
Chore
Swapped Korean filter list source
Replaced the List-KR blocklist with the filterslists-KO alternative.
2026-08-10New filtering powers arrived this week, including cookie manipulation and a way to target content inside HTML template tags.6 changes
Feature
Cookie set/unset/given values support
Added the ability for filters to set, unset, or check specific cookie values (#3936).
Feature
New `content(...)` procedural operator
Filters can now look up elements hidden inside `<template>` tags on a page.
Fix
Improved clipboard-write protection
Refined the scriptlet that stops websites from silently writing to your clipboard (worked on twice this week).
Fix
Safer popup blocking on mv3
Popup-blocking rules now respect excluded origins and the `to=` option when converted for Manifest V3.
Feature
Broad scriptlet exceptions on mv3
Added support for the `#@#js()` exception syntax so entire scriptlets can be disabled where needed.
Fix
Regression fix
Patched a problem introduced by an earlier change (commit 505fbc7a75).
2026-08-03The week centered on releasing a new stable version, publishing a self-hosted Chromium package, and fixing mv3 list-management issues.6 changes
Chore
New stable release
Cut a new stable version of the extension with an updated changelog.
Chore
Self-hosted CRX package published
Started distributing the Chromium package directly after fixing its download URL.
Fix
Fixed imported-lists display on mv3
The 'Imported lists' section now updates properly when lists change.
Fix
Better removeParams rules on mv3
URL-stripping rules were patched to carry main_frame and initiatorDomains properties correctly (done twice).
Feature
Permission warning for sandbox filters
The mv3 build now warns users that sandbox-based filters require the 'user scripts' permission.
Refactor
Improved json-edit and scriptlet internals
Enhanced the `json-edit` scriptlet and reworked how scriptlets receive extra arguments.
2026-07-27A quieter week focused on small refinements, including better clipboard protection and a fix ensuring enabled filter rules actually apply on mv3.5 changes
Fix
Enabled rulesets no longer skipped on mv3
Fixed a bug where some enabled filter rule sets were unintentionally not applied in the Manifest V3 build.
Fix
Improved prevent-clipboard-write scriptlet
Continued refining the scriptlet that blocks websites from writing to your clipboard.
Feature
excludeMatches accepts multiple values
The excludeMatches setting can now take several values at once instead of just one.
Docs
Documentation link added on mv3
Added a link to documentation within the Manifest V3 interface.
Chore
Translation updates
Imported community translations from Crowdin multiple times during the week.
2026-07-20Work spanned a release candidate, compatibility with older Chromium versions, and improvements to logging and scriptlet utilities.6 changes
Chore
Release candidate prepared
Created new revisions for a release candidate along with changelog updates.
Fix
Kept older Chromium support
Maintained compatibility with Chromium 109 and earlier versions.
Feature
Stock lists movable to imported lists on mv3
Users of the Manifest V3 build can now move built-in filter lists into their imported list group.
Fix
Logger preserves whitespace
The request logger no longer strips whitespace characters from entries.
Docs
Documentation for trusted-click-element
Added reference documentation for the `trusted-click-element` scriptlet.
Refactor
Improved proxy-apply utility
Enhanced the `proxy-apply` scriptlet and clarified it as a weak dependency of its config counterpart.
Dependencies and code review
Dependency advisories
Security Watch
4 vulnerable packages (10 advisories) across 91 scanned dependencies.
brace-expansion 1.1.12
3 advisories. Fixed in 5.0.7.
How it can be abusedThis library expands patterns like file globs and is only pulled in by npm development tools such as the linter used when building this project; it never runs inside the shipped browser extension. A developer who lints a repository containing attacker-crafted filenames or paths could hang or crash their build machine with memory exhaustion, but extension users are not affected.
- highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
- highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
- highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
flatted 3.3.3
2 advisories. Fixed in 3.4.0.
How it can be abusedAn attacker who can feed crafted data into flatted's parse function could crash the process or tamper with object prototypes, but in this repo the package is only used by developer build and lint tooling, never shipped to users, so only a developer running compromised build scripts could be affected.
- highGHSA-25h7-pfq9-p65fflatted vulnerable to unbounded recursion DoS in parse() revive phase
- highGHSA-rf6f-7fwh-wjghPrototype Pollution via parse() in NodeJS flatted
js-yaml 4.1.0
2 advisories. Fixed in 3.15.0.
How it can be abusedAn attacker who can influence YAML files parsed during development or packaging, such as filter-list metadata or build configuration, could craft deeply nested merge keys that make the parser burn CPU for minutes on one small file, stalling builds. This only affects people building uBlock Origin from source, not the extension's end users, because js-yaml never runs inside the browser.
- highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
- highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported
minimatch 3.1.2
3 advisories. Fixed in 10.2.3.
How it can be abusedAn attacker could craft a file path or pattern that makes minimatch freeze the process while it tries to match it, but here minimatch is only used by build and lint scripts on developer machines, never inside the extension itself. Only developers running those tools with attacker-controlled input (for example a malicious repo or filename) would be affected; end users of uBlock Origin are not exposed.
- highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
- highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
- highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required