Popup vs. popunder: what's actually happening
A popup ad opens a new window or tab on top of the page you're on. A popunder opens behind the current window, so you don't notice it until you close or minimize what you're looking at — by which point it's already loaded whatever it was going to load. Both are triggered the same way: a script on the page calls window.open(), usually the moment you click anywhere on the page, not just on an actual link.
Why Chrome's built-in popup blocker doesn't catch everything
Chrome already blocks some popups automatically — specifically, ones opened without any user interaction at all (e.g. immediately on page load). The gap is scripts that piggyback on a real click: you click a play button or a download link, and the same click that was "supposed" to do one thing also triggers a hidden window.open() call. Because there technically was a click, Chrome's default heuristic often lets it through.
The technique that actually closes the gap
The fix is a stricter version of the same idea: only allow window.open() within about a second of a trusted event — a real click, keydown, pointerdown, or touchstart. Browsers set a flag (isTrusted) on real input events that no page script can fake, so this isn't guesswork: either the browser says a human just did something, or it doesn't. A popup ad's script calling window.open() from a timer, or piggybacking on an unrelated click a second too late, gets nothing back. A real "open in new tab" click still works exactly like normal.
Why this matters for sign-in popups specifically
A lot of blunter popup blockers block all new windows, which breaks OAuth sign-in flows (the "Sign in with Google" popup, for instance) since those are also implemented via window.open(). Because the gesture-check approach only cares about whether a real click happened recently — not what the popup is for — a genuine sign-in click still opens its popup normally, while an ad script with no real click behind it doesn't.
Step-by-step: block popups in Chrome
- Install Jas Adblock from the Chrome Web Store.
- The popup blocker is on by default — no setup needed.
- Click the toolbar icon on any site to see a live "popups blocked on this tab" count.
- If a specific site misbehaves, use the per-site toggle in the popup to turn blocking off just for that site.
FAQ
Will this break legitimate popups, like bank OTP windows or sign-in flows?
No — because those are opened by a real click, the gesture check lets them through. Only window.open() calls with no recent real click behind them get blocked.
Why do some popups still get through?
A script that opens a popup within the trusted-gesture window (i.e., disguised as a reaction to your real click) can still slip through, since the check can't distinguish intent, only whether a real click happened recently. This is the same tradeoff every popup blocker, including Chrome's own, makes.
Is this different from Chrome's "Pop-ups and redirects" setting?
Chrome's built-in setting mainly blocks popups with no user interaction at all. A dedicated extension's gesture-check is stricter and catches popups that piggyback on a real click, which Chrome's own default often misses.