Researchers Say Chrome Extension Poper Blocker Steals Browsing and AI Chat Data

Summary

Bay Area Labs says Poper Blocker, a popular Chrome extension, exfiltrates browsing histories, screenshots, and AI chat data. The extension remained on the Chrome Web Store after researchers reported it to Google.

Key points

Bay Area Labs says Poper Blocker collects full page URLs, screenshots, page data, AI chatbot conversations, approximate locations, and cross-device identifiers.
The researchers say the extension uses obfuscation, sandbox detection, and a command-and-control server to receive instructions; it reportedly waits 24 hours after installation before downloading malicious components.
Poper Blocker had more than 2 million claimed active users and displayed Google's Featured and Established Publisher badges, according to the article.
Bay Area Labs reported the extension to Google in May 2026, but it remained available on the Chrome Web Store as of publication; Google did not respond to the outlet's request for comment.
The article says two other extensions from the same developer, CrxMouse and BlockSite, also remain available; the three extensions have nearly 4 million combined Chrome Web Store users.
In automated tests, Bay Area Labs found that one in five ad blockers with more than 100,000 users exfiltrated browsing histories, though the outlet withheld the names of apps it had not independently verified.
Researchers warn that obfuscated data exfiltration may evade data-loss-prevention controls, while users may have difficulty identifying risky extensions from store listings alone.

Article Details

Event Type: Spyware and sensitive-data exfiltration through browser extensions distributed via the Chrome Web Store.
Impact: Bay Area Labs reports that Poper Blocker collects and exfiltrates users’ browsing histories, screenshots, and AI chatbot interactions, and associates collected data with approximate locations and cross-device identifiers. The article says Poper Blocker remains available despite being reported to Google in May 2026. CrxMouse and BlockSite, also attributed to Big Star Labs, remain available on the Chrome Web Store; BlockSite has also been downloaded more than 10 million times on Google Play.

People

James ArnottBay Area Labs founder who commented on the difficulty of detecting Poper Blocker’s obfuscated data exfiltration.

Vendors

Big Star Labsthat performed malicious data theft, all developed — or, more likely, acquired — by a company called "Big Star Labs." At the time, the seven apps enjoyed more than 11 million cumulative users.

Products

BlockSiteapps appear to have survived the years since, but at least three — Poper Blocker, "CrxMouse," and "BlockSite" — remain live on the Chrome Web Store today. In combination, they serve nearly 4 million users from the Chrome Web StoreMillions of people have downloaded infostealers disguised as legitimate ad-blocking browser extensions, in part because Google has provided them with seals of approval on the Chrome Web Store.CrxMouseNot all of those apps appear to have survived the years since, but at least three — Poper Blocker, "CrxMouse," and "BlockSite" — remain live on the Chrome Web Store today. In combination, they serve nearly 4 million Google Playusers from the Chrome Web Store. BlockSite has also been downloaded more than 10 million times on Google Play.Manifest V3 (MV3)persists, even though Google banned this behavior in its latest rulebook for browser extensions, Manifest V3 (MV3).Poper BlockerThat's the word from Bay Area Labs, which uncovered one such app, "Poper Blocker," lurking in the Chrome Web Store. Poper Blocker has every trapping of a legitimate, mainstream app: It sports a big, green "Featured"