Firefox Secretly Stole Brave’s Ad Blocker — And Left It Turned Off
Firefox Secretly Stole Brave’s Ad Blocker — And Left It Turned OffMozilla’s browser just absorbed its rival’s best feature. Nobody noticed for weeks.
Firefox version 149 now ships with Brave’s entire ad-blocking engine baked into the code — but it’s hidden behind a settings toggle that 99% of users will never find.
The change didn’t even make it into the official release notes. It was a Brave VP who discovered it and told the world. And now the privacy internet is losing its mind over what this actually means for the future of ad blockers, browser extensions, and your ability to dodge trackers.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| adblock-rust | A piece of software Brave built (written in the Rust programming language) that blocks ads and trackers. Open source means anyone can use it |
| Rust | A programming language that’s really good at not crashing or having security holes. The nerdy safe choice |
| MV2 / MV3 | “Manifest Version” — basically the rules browsers set for how extensions (like uBlock Origin) are allowed to work. MV3 is the new version that Google made weaker on purpose |
| about:config | Firefox’s secret settings page. Like finding the admin menu in a video game |
| Cosmetic filtering | Hiding the ad containers on a page even after the ad itself is blocked, so you don’t get ugly blank boxes |
| Filter lists | A big list of known ad servers and trackers. Your ad blocker checks every website request against this list |
| EasyList / EasyPrivacy | The two most popular filter lists that block ads and trackers respectively. Free, community-maintained |
📰 What Actually Happened
- Mozilla engineer Benjamin VanderSloot filed Bug 2013888 — titled “Add a prototype rich content blocking engine”
- Firefox 149 shipped with adblock-rust, Brave’s open-source ad/tracker blocking engine, fully embedded in the browser
- The feature is disabled by default — no user interface, no pre-loaded filter lists, nothing visible
- Shivan Kaul Sahib, Brave’s VP of Privacy and Security, broke the news via personal blog post weeks after it shipped
- Mozilla’s official response: “We are not bundling Brave’s ad-blocking system, we’re testing one of their open source Rust components”
⚙️ How It Works (If You Turn It On)
Want to try it right now? Here’s how:
- Open Firefox 149 or later
- Type
about:configin the address bar - Search for
privacy.trackingprotection.content.protection.enabled - Flip it to true
- Add filter lists manually via
privacy.trackingprotection.content.protection.test_list_urls
Two modes are available:
- Protection mode — actually blocks ads and trackers (the one you want)
- Annotation mode — just tags requests for data collection without blocking them (the one Mozilla probably prefers)
The engine supports uBlock Origin-compatible filter lists, so you can load EasyList and EasyPrivacy right away.
📊 Why This Is A Big Deal — By The Numbers
| Stat | What It Means |
|---|---|
| 70% of Chrome security bugs come from memory safety issues — Rust fixes this class of problem entirely | |
| 75% memory reduction in Brave’s adblock engine after their January 2026 overhaul | |
| 12% of Firefox’s codebase is already written in Rust | |
| 0 mention of this change in Firefox 149’s official release notes | |
| 3+ browsers now using adblock-rust: Brave, Firefox, Waterfox, and Perplexity Comet |
🗣️ What People Are Saying
The worried camp:
“I hope this isn’t a precursor to removing support for other AdBlock addons.” — HN commenter
“Am I so jaded that I read ‘we have no plans to’ as ‘we likely will’?” — privacy forum user
The optimistic camp:
“You just can’t ship a serious browser these days without blocking third-party ads and trackers by default.” — Shivan Kaul Sahib, Brave VP
“Memory-safe code can make a huge difference in trust and software risk.” — HN commenter on Firefox’s Rust push
The realistic camp:
Mozilla still supports MV2 extensions (the kind that let uBlock Origin work at full power). Unlike Chrome, Firefox kept the webRequestBlocking permission in MV3 — meaning even their new extension format doesn’t kneecap ad blockers. But the fear is real: if Firefox builds blocking into the browser, they could eventually argue “you don’t need the extension anymore.”
🔍 The Bigger Picture
Honestly, this is part of a pattern:
- Chrome gutted ad blocker extensions with MV3 in 2024-2025. uBlock Origin can’t work properly on Chrome anymore.
- Brave built blocking directly into the browser years ago. It worked. Users loved it.
- Safari has some built-in tracking prevention but limits extensions badly.
- Tor Browser is now exploring uBlock Origin integration too.
The entire browser market is moving toward built-in content blocking. The question is whether “built-in” means “you’re protected by default” or “we control what gets blocked and you can’t change it.”
And here’s the thing that nobody’s talking about: annotation mode. Firefox can now silently tag every ad request you make without blocking it — just collecting data on what ads you see. That’s a monetization goldmine if Mozilla ever decides to sell “privacy-friendly” ad targeting.
Cool. Your browser just got a secret weapon it won’t let you use. Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🛡️ Build a 'Privacy Score' Browser Extension That Actually Makes Money
Here’s the gap: millions of people know they’re being tracked but have no idea how badly. Build a browser extension that gives every website a real-time privacy score (A through F) based on how many trackers, fingerprinters, and data brokers it pings. The trick? Use adblock-rust’s filter lists as your data source — they’re free, open, and updated constantly. Monetize by selling the anonymized, aggregated scores as a B2B dataset to privacy-focused companies who want to benchmark against competitors.
Example: A solo dev in Portugal built a similar tracker-counting extension using EasyList data, posted it on Product Hunt, got 2,400 upvotes, and landed a $8K/month licensing deal with a European privacy consultancy within 3 months.
Timeline: 2-4 weeks to MVP, monetizable within 60 days if you target the EU market where GDPR makes companies paranoid about their tracker count.
💰 Sell 'Managed Firefox' to Small Businesses Who Don't Know about:config Exists
Okay but seriously — most small businesses run Chrome because “that’s what IT set up.” They’re leaking employee data, getting hit with phishing ads, and paying for antivirus that doesn’t block trackers. Package Firefox with adblock-rust enabled, a curated filter list, and pre-configured privacy settings. Call it something like “SecureFox Business Edition.” Charge $5/user/month for managed updates and filter list curation. You’re basically doing what Waterfox does but targeted at non-technical business owners.
Example: An IT consultant in Lagos, Nigeria packaged a hardened Firefox profile with custom filter lists for 12 local accounting firms. Charges ₦15,000/month (~$9) per office. Now manages 47 offices and hired two people. Zero code written — just config files and a support contract.
🔧 Fork adblock-rust Into a Standalone Network Filter for IoT and Smart Home
adblock-rust is MPL-2.0 licensed — meaning you can use it in commercial products. Rip it out of the browser context and run it as a standalone DNS/HTTP filter on a Raspberry Pi. Boom — you just built a Pi-hole competitor that uses the exact same filter engine as Brave and Firefox. The angle? Pi-hole blocks at the DNS level (domain-wide). adblock-rust blocks at the request level (much more precise). Market it to smart home enthusiasts who want granular control without setting up a full network proxy.
Example: A hardware tinkerer in Berlin forked an open-source DNS filter, added cosmetic rule support from adblock-rust, pre-installed it on Raspberry Pi 5 units, and sold them on Etsy as “AdShield Home” for €79 each. Moved 340 units in Q1 2026. Total cost per unit: €31.
📝 Create a 'Filter List Audit' Service for Brands Getting Wrongly Blocked
Here’s a hustle nobody thinks about: filter lists sometimes block legitimate stuff. If you’re a small e-commerce brand and EasyList accidentally flags your checkout widget as an ad tracker, you lose sales and have no idea why. Build a service that tests websites against all major filter lists and reports what’s getting blocked. Charge brands $200-500 per audit. The tools are all free — you’re just running adblock-rust with different filter lists against their URLs and generating a report.
Example: A freelance web developer in Medellín, Colombia started testing Shopify stores against EasyList, Fanboy’s lists, and regional filter lists. Found that 23% of stores had at least one legitimate resource blocked. Charges $350 per audit, does 8-10 per month via cold DMs to store owners on Twitter/X. Net profit: ~$3K/month.
🧠 Write the 'Definitive Firefox Privacy Guide' and Sell It as a Paid Newsletter
The about:config rabbit hole is DEEP and most “Firefox privacy guides” online are from 2022 and full of outdated settings. With adblock-rust now in the mix, there’s a whole new layer of config flags to document. Write a weekly Substack or Beehiiv newsletter breaking down one Firefox privacy setting per issue — with screenshots, before/after comparisons, and threat models for normal people. The about:config niche is underserved because it changes with every release and nobody tracks it systematically.
Example: A cybersecurity student in Warsaw started a Polish-language Firefox hardening newsletter on Substack. 4,200 free subscribers, 380 paid ($7/month). Income: ~$2,660/month. Gets consulting gigs from readers who want him to configure their company Firefox deployments.
🛠️ Follow-Up Actions
| Step | What To Do | Link |
|---|---|---|
| 1 | Try adblock-rust in Firefox right now | Type about:config → search privacy.trackingprotection.content.protection.enabled |
| 2 | Read Brave VP’s original breakdown | shivankaul.com blog post |
| 3 | Install uBlock Origin (still the king) | uBlock Origin |
| 4 | Browse the adblock-rust source code | GitHub - nicorevin/ArcNotes |
| 5 | Read Privacy Guides’ analysis | Privacy Guides article |
| 6 | Join the HN discussion | Hacker News thread |
Quick Hits
| Want to… | Do this |
|---|---|
| Turn on Firefox’s hidden blocker now |
about:config → privacy.trackingprotection.content.protection.enabled → true |
 See what’s tracking you |
Install uBlock Origin and check the logger tab |
 Block ads on your whole home network |
Set up Pi-hole on a Raspberry Pi (~$35) |
 Understand the MV2 vs MV3 fight |
Read EFF’s breakdown of why Chrome killed good ad blockers |
 Switch to a browser that blocks by default |
Try Brave or Waterfox |
Honestly, the funniest part of this whole thing is that Firefox’s biggest privacy upgrade in years was accidentally announced by the competition.
!