Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

Summary

Island researchers discovered that the popular Chrome extension 'Adblock for YouTube' (10M+ installs, Featured on Chrome Web Store) contains dormant capability to execute arbitrary JavaScript code on any website via remote server configuration, without requiring extension updates or store review. While no malicious payload has been distributed, the extension runs on all websites despite claiming YouTube-only functionality, has prior ties to ad-injection SDKs and related extensions removed for malware, and requests extensive permissions that could enable data theft and account compromise if activated.

Full text

Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability Ravie LakshmananJun 25, 2026Browser Security / Malware An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code. According to Island, the extension, named Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk), has more than 10 million installs and carries a Featured badge on the Chrome Web Store. The extension description states that it allows users to prevent web page elements like ads, including preroll ads, from being displayed on the video sharing platform, as well as on external sites that load YouTube. While the add-on offers the promised functionality, it also features capabilities to run arbitrary JavaScript code. "It also contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed," researchers Oleg Zaytsev and Shachar Gritzman said in a report shared with The Hacker News. "In practical terms, that could mean reading pages, stealing data, and acting as the user inside personal accounts, work apps, admin panels, and other sensitive browser sessions." It's worth emphasizing here that there is no evidence malicious payload has been distributed to users in this manner, but the mere presence of the capability, coupled with ties to other ad-blocking extensions that have since been removed from the storefront for malware, raises privacy and security risks, Island added. The list of related extensions that have been taken down is listed below - Adblock for Chrome (ID: onomjaelhagjjojbkcafidnepbfkpnee) Adblock for You (ID: ogcaehilgakehloljjmajoempaflmdci) AdBlock Suite (ID: gekoepiplklhniacchbbgbhilidiojmb) Adblock for YouTube has been on the Chrome Web Store since 2014, starting off as a basic YouTube ad blocker before it changed ownership four years later. Early iterations of the extension were found to ship with an ad-injection software development kit (SDK) named Unistream SDK, although it was removed in June 2024. What's been constant is the presence of remote-controlled script injection paths since February 2025, opening the door to the creation of arbitrary "<script> elements using a bespoke scriptlet rule ("trusted-create-element") defined by the extension author that can, in turn, access sensitive data. "At the time of our analysis, trusted-create-element was not active in the server response," the researchers explained. "The capability is dormant, not absent. Activating it requires a single server-side change, no extension update, no store review." Compounding the risk further is the fact that ad blocker extensions typically request extensive permissions to inspect requests, alter pages, hide elements, and adjust their behavior as ad systems evolve. Specifically, it's been found that contrary to its name, the extension runs on every website a user visits on the browser, while adding a check that activates only when the current URL contains "youtube.com." However, in reality, the check only verifies if the string corresponding to "youtube.com" appears anywhere in the URL, and does not validate the hostname, frame origin, or embedded player context. This means that the check can be trivially bypassed by putting youtube.com anywhere in the URL, as depicted in the following URL patterns - www.facebook.com/page?ref=youtube.com bank.example.com/search?q=youtube.com internal.corp.com/redirect?from=youtube.com "The concern is not a single suspicious line of code," Island said. "It is the combination: a high-install extension with all-site access, a remote-controlled injection path, prior ad-injection infrastructure, a major ownership and codebase change, and related extensions that were removed from the Chrome Web Store for malware." The Hacker News has contacted the developer of the extension for comment, and we will update the story if we hear back. The disclosure comes as Palo Alto Networks Unit 42 said it detected 18 browser extensions impersonating consumer brands with an aim to monetize through affiliate marketing. "Upon installation, all extensions open the .shop domain in a new tab," Unit 42 said. "The .shop domain redirects to another domain. The domain presents a page citing that further action is required. The page cites incompatibility issues and asks users to install a gaming-oriented browser." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Ad Blocker, browser security, chrome extension, data theft, Island, JavaScript, Malware, Privacy Risk, Unit 42, YouTube ⚡ Top Stories This Week Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit Palo Alto Warns of Active Exploitation of PAN-OS GlobalProtect VPN Flaw ⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More ⭐ Featured Resources Get the 2026 Guide to Govern and Secure Enterprise AI Agents at Scale [Watch Demo] See Which Security Gaps Attackers Could Exploit First AI Can’t Stop Every Attack. Learn How Zero Trust Can Block What’s Unknown Have You Outgrown Your MDR? 7 Warning Signs Every CISO Should Check

Entities