Here you go, from the repo:

  const visitAd = function (ad) {
    function timeoutError(xhr) {
      return onVisitError.call(xhr, {
        type: 'timeout'
      });
    }

    const url = ad && ad.targetUrl, now = markActivity();

    // tell menu/vault we have a new attempt
    broadcast({
      what: 'adAttempt',
      ad: ad
    });

    if (xhr) {

      if (xhr.delegate.attemptedTs) {

        const elapsed = (now - xhr.delegate.attemptedTs);

        // TODO: why does this happen... a redirect?
        warn('[TRYING] Attempt to reuse xhr from ' + elapsed + " ms ago");

        if (elapsed > visitTimeout)
          timeoutError();
      }
      else {

        warn('[TRYING] Attempt to reuse xhr with no attemptedTs!!', xhr);
      }
    }

    ad.attempts++;
    ad.attemptedTs = now;

    if (!validateTarget(ad)) return deleteAd(ad);

    return sendXhr(ad);
    // return openAdInNewTab(ad);
    // return popUnderAd(ad)
  };

  const sendXhr = function (ad) {

    // if we've parsed an obfuscated target, use it
    const target = ad.parsedTargetUrl || ad.targetUrl;

    log('[TRYING] ' + adinfo(ad), ad.targetUrl);

    xhr = new XMLHttpRequest();

    try {
      xhr.open('get', target, true);
      xhr.withCredentials = true;
      xhr.delegate = ad;
      xhr.timeout = visitTimeout;
      xhr.onload = onVisitResponse;
      xhr.onerror = onVisitError;
      xhr.ontimeout = onVisitError;
      xhr.responseType = ''; // 'document'?;
      xhr.send();
    } catch (e) {
      onVisitError.call(xhr, e);
    }
  }

  const onVisitResponse = function () {

    this.onload = this.onerror = this.ontimeout = null;

    markActivity();

    const ad = this.delegate;

    if (!ad) {

      return err('Request received without Ad: ' + this.responseURL);
    }

    if (!ad.id) {

      return warn("Visit response from deleted ad! ", ad);
    }

    ad.attemptedTs = 0; // reset as visit no longer in progress

    const status = this.status || 200, html = this.responseText;

    if (failAllVisits || status < 200 || status >= 300) {
      return onVisitError.call(this, {
        status: status,
        responseText: html
      });
    }

    try {

      if (!isFacebookExternal(this, ad)) {

        updateAdOnSuccess(this, ad, parseTitle(this));
      }

    } catch (e) {

      warn(e.message);
    }

    xhr = null; // end the visit
  };

That’s pretty much it! Let me know if it doesn’t make sense, I can annotate it

the part that’s safe is in the browser. it’s a basic fact of how http requests work that you can just request data and then not read it.

also, “task managering the popups”? unless i’ve missed some very weird development that has literally never worked, because popup windows are part of the parent process.

What makes you think uBlock is safe without checking relevant code sections?