By Damilola Emmanuel, who makes Tabmoat. Updated .
You stop them with a blocker that checks what you actually clicked before it lets a new tab open. Chrome’s own pop-up blocker generally allows a new tab that opens straight after a click, and these sites make sure every click on the page counts. With Tabmoat, a tab only opens if the thing you clicked leads there.
Why do these tabs get past Chrome’s pop-up blocker?
Chrome blocks pop-ups that open on their own. It allows the ones that open right after you click, because that’s how normal sites open a sign-in window or a link in a new tab. Ad scripts on streaming and download sites use that rule. They listen for your first click anywhere on the page, often on the Play button, and open their tab at that exact moment, so Chrome counts it as your doing.
The tricks they use to get your click:
- An invisible layer stretched over the whole page, so your click goes to the ad instead of the video.
- A script that hooks the player’s own buttons, so pressing Play or Mute opens the ad.
- A hidden link the script clicks for you during your click.
- A “tab-under”: the site opens itself again in a new tab and turns the tab you were on into the ad, so you only find it later.
Will a normal ad blocker stop them?
A good one stops most of them. Blockers like uBlock Origin Lite work from public lists of ad servers, and those lists include the big pop-up networks. When I tested Tabmoat and uBlock Origin Lite on the same sites, both stopped nearly every ad tab.
Lists miss new addresses. Pop-up networks keep moving to web addresses that no list has caught yet, and while building Tabmoat I caught a pop-up tab from an address that wasn’t on any of the lists Tabmoat uses. Checking what you clicked still works on a tab like that, because it doesn’t depend on knowing the address.
How does Tabmoat stop them?
Tabmoat runs on the page before any of the site’s own scripts. When something tries to open a new tab, it checks the click that triggered it:
| What you clicked | New tab allowed? |
|---|---|
| A link, and the tab goes to that link’s site | Yes |
| Something on the same site (a card that opens in a new tab) | Yes |
| A sign-in, share or payment button | Yes |
| Empty page, a video, or a poster that leads to another site | No |
| A video player’s own button (Play, Mute, Seek) | No |
| An ad network’s landing page, whatever you clicked | No |
When Tabmoat blocks one, it hands the ad script a fake window instead of an error. If the script saw an error, it would try again on your next click, and the player’s buttons would stop working while it kept trying. With the fake window, the script believes its tab opened and stops.
Tabmoat also keeps a record of the servers it catches. When a script opens a pop-under, Tabmoat blocks the server it came from on that site straight away, and on every site once it has caught the same server on two.
Can I fix this without installing anything?
Only partly. In Chrome, go to Settings, then Privacy and security, then Site settings, then Pop-ups and redirects, and make sure sites are not allowed to send pop-ups. That stops pop-ups that open without a click. It won’t stop the ones tied to your click, and on the sites I tested those were the ones I kept running into.
You can also close the extra tab and go back, but some pages need four or five clicks before the video plays, and each one opens another tab.
Questions people ask
Is it safe to keep clicking until the video plays? The tabs these sites open often lead to scam pages, like fake virus warnings or fake browser updates. Closing them without clicking anything on them is the safe habit.
Will Tabmoat break the video? It’s built not to. The fake window exists so the player keeps working. If a site does break, switch Tabmoat off for that site and email me the address at support@middledott.com.
Does Tabmoat block “verify you are human” checks? No. It leaves Cloudflare Turnstile, reCAPTCHA and hCaptcha alone so sign-ins and downloads still work.