An ad blocker stops your browser loading advertising content, and that work splits into three separate actions: cancelling network requests to ad and tracker domains, hiding the page elements those requests would have filled, and blocking the scripts that profile you across sites. Only the first action carries real security weight. A request that never leaves your browser cannot deliver a payload.
The three layers, and which one protects you
Network-level blocking does the heavy lifting. Filter lists match an outgoing request against known ad and tracking domains, and the browser drops it before any third-party code executes.
Cosmetic filtering is the second layer. It hides the blank frames and placeholder boxes left behind after a request is dropped, which is tidiness rather than defence.
Script blocking is the third. It stops fingerprinting and analytics code that would otherwise run with full access to the page you are reading.
Why the FBI put ad blockers in a fraud advisory
On 21 December 2022 the FBI’s Internet Crime Complaint Center published advisory I-122122-PSA, warning that criminals were buying search engine advertisements using domains that closely resemble real businesses. Users clicking those adverts reached convincing clone pages that served ransomware or harvested login credentials.
The advisory’s own list of precautions includes using an ad blocking extension when performing internet searches. That is a federal agency treating ad filtering as a control against credential theft, not as a preference about clutter. Anyone reading up on the main categories of malware will recognise the delivery pattern: the payload is ordinary, the delivery route is what changed.
Video: Keeper Security
What Manifest V3 changed in Chrome
Chrome’s extension platform moved to Manifest V3. Google’s documentation states plainly that the webRequestBlocking permission is no longer available for most extensions, with policy-installed extensions the exception, and directs developers to the declarativeNetRequest API instead.
The difference is about who does the deciding. The old permission let an extension inspect every request in its own code. The replacement has the extension hand Chrome a rule list in advance, and Chrome performs the matching itself.
Those rule lists have ceilings. Chrome guarantees an extension at least 30,000 static rules across its enabled rulesets, and allows up to 30,000 safe dynamic rules on top.
What each browser can still block
| Browser | Deep filtering (webRequestBlocking) | Declarative rules (declarativeNetRequest) | Worth knowing |
|---|---|---|---|
| Chrome | Removed under Manifest V3, except policy-installed extensions | Since Chrome 84 | 30,000 static rules guaranteed per extension |
| Edge | Same Chromium extension platform as Chrome | Same as Chrome | Microsoft shows Manifest V2 deprecation warnings during 2026; enterprise deprecation expected to begin early 2027 |
| Firefox | Still supported, available since Firefox 48 | Since Firefox 113 | The only major browser offering both approaches side by side |
| Safari | Never supported | Since Safari 15 | Content blockers compile to bytecode and receive no access to browsing history |
Firefox is the outlier worth noting, because an extension there can still run its own filtering logic. Safari arrived at a similar declarative model years earlier by design, and Apple’s developer documentation frames the privacy trade as deliberate: the blocker never learns which sites you visited.
Where a blocker stops being enough
Filtering adverts does nothing about a file you downloaded and ran yourself. If something already slipped through, the job moves to checking the machine for malware rather than tuning filter lists.
Treat the blocker as the layer that shrinks your exposure, and resident scanning as the layer that catches what lands. Our rundown of antivirus options worth paying for covers the second half of that pairing.
Ad blocker questions, answered
Does an ad blocker replace antivirus software?
No. It reduces how often you encounter a malicious advert, but it cannot inspect or quarantine a file already on disk. The two controls address different stages of the same attack.
Did Manifest V3 break ad blocking in Chrome?
Blocking still works, through a different mechanism. Extensions now supply Chrome with a capped rule list rather than filtering each request in their own code.
Is a browser extension or a DNS filter better?
They cover different ground. A DNS filter blocks domains for every device on the network but cannot hide page elements, while an extension sees the page and can do both.
