How it actually works.

Network Layer Blocking

Blocked before the first byte leaves your machine.

Most browsers delegate ad blocking to extensions that run inside the page renderer — they intercept requests after the browser has already resolved DNS and opened a connection. Kairon does the opposite.

Blocking is built in, not bolted on. The filter engine sits inside Electron's session.webRequest layer, which fires before any network I/O happens. When you navigate to a URL, Kairon's engine — built on the @cliqz/adblocker-electron library — evaluates every sub-resource request (images, scripts, fonts, XHR calls, WebSocket upgrades) against a compiled rule set derived from EasyList and EasyPrivacy. Matching requests are cancelled at the onBeforeRequest hook; no TCP connection is opened, no bytes transfer.

• Built-in engine, no extension — blocking runs in the browser's main process, so there is no extension to install, update, or pay for, and no extension memory overhead in the renderer.
• Compiled rule sets with caching — EasyList and EasyPrivacy are compiled into a decision engine; every decision is cached, so repeated requests skip the synchronous match entirely.
• Three modes — Off, Standard, and Aggressive, switchable from the shields menu or Settings. Cosmetic-only mode loads no network filters.
• Fail-open reliability — an internal blocker error never leaves a request hanging or cancels navigation, and main-frame/document responses are never modified or blocked.
• Cosmetic filtering — after a page loads, generated CSS hides filter-matched elements, navigator.sendBeacon is stubbed, and preload/preconnect links are stripped (while blocking is on).