An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code.
According to Island, the extension, named Adblock for YouTube, has more than 10 million installs and carries a Featured badge on the Chrome Web Store.
The extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) description states that it allows users to prevent web page elements like ads, including preroll ads, from being displayed on the video sharing platform, as well as on external sites that load YouTube. While the add-on offers the promised functionality, it also features capabilities to run arbitrary JavaScript code.
"It also contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed," researchers Oleg Zaytsev and Shachar Gritzman said in a report shared with The Hacker News.
"In practical terms, that could mean reading pages, stealing data, and acting as the user inside personal accounts, work apps, admin panels, and other sensitive browser sessions."
It's worth emphasizing here that there is no evidence malicious payload has been distributed to users in this manner, but the mere presence of the capability, coupled with ties to other ad-blocking extensions that have since been removed from the storefront for malware, raises privacy and security risks, Island added.
The list of related extensions that have been taken down is listed below -
- Adblock for Chrome (ID: onomjaelhagjjojbkcafidnepbfkpnee)
- Adblock for You (ID: ogcaehilgakehloljjmajoempaflmdci)
- AdBlock Suite (ID: gekoepiplklhniacchbbgbhilidiojmb)
Adblock for YouTube has been on the Chrome Web Store since 2014, starting off as a basic YouTube ad blocker before it changed ownership four years later. Early iterations of the extension were found to ship with an ad-injection software development kit (SDK) named Unistream SDK, although it was removed in June 2024.
Island also found that, despite its YouTube-focused name, the extension had broad site access. That level of access is common for ad blockers, which often need to inspect requests, alter pages, hide elements, and respond to changes in ad delivery systems. The concern in this case was how that access combined with remote-controlled scriptlet execution.
At the time of Island's analysis, the extension added a check that activated when the current URL contained "youtube.com." But the check looked for the string anywhere in the URL, rather than validating the hostname, frame origin, or embedded player context.
This meant the check could be bypassed by putting youtube.com anywhere in the URL, as depicted in the following URL patterns -
- www.facebook.com/page?ref=youtube.com
- bank.example.com/search?q=youtube.com
- internal.corp.com/redirect?from=youtube.com
"The concern is not a single suspicious line of code," Island said. "It is the combination: a high-install extension with all-site access, a remote-controlled injection path, prior ad-injection infrastructure, a major ownership and codebase change, and related extensions that were removed from the Chrome Web Store for malware."
The disclosure comes as Palo Alto Networks Unit 42 said it detected 18 browser extensions impersonating consumer brands with an aim to monetize through affiliate marketing.
"Upon installation, all extensions open the .shop domain in a new tab," Unit 42 said. "The .shop domain redirects to another domain. The domain presents a page citing that further action is required. The page cites incompatibility issues and asks users to install a gaming-oriented browser."
Update: AdBlock Ltd. says the latest version addresses the reported path
After publication, AdBlock Ltd founder Mathias Rochus emailed The Hacker News to say the extension has never used the capability and never will, citing its 4.4 rating across hundreds of thousands of reviews.
He said the company was preparing a Chrome Web Store update to validate the YouTube hostname instead of matching the string anywhere in the URL, and to prevent the server configuration from creating or injecting an executable script on the page.
The Chrome Web Store now serves version 7.2.3 of the extension. A static inspection by The Hacker News found that the exact trusted-create-element scriptlet name referenced in Island's report was no longer present in the package, and the earlier weak youtube.com string check appears to have been replaced with hostname-based validation.
However, the extension still fetches remote rules, supports scriptlet rules, and executes code in the page's MAIN world. Those capabilities are not unusual for an ad blocker, but they remain sensitive because they depend on how tightly the remote configuration and scriptlet arguments are constrained.
Our Static review suggests the specific reported path has likely been addressed, but runtime validation would be required before calling the broader architecture risk-free.
Rochus also said the trusted scriptlets named in the report, including trusted-create-element, are not code his company wrote. He said they are part of AdGuard's open-source scriptlet library that mainstream ad blockers ship, and that the extension's server sends configuration that selects which built-in scriptlet runs.
Correction: An earlier version of this article described trusted-create-element as a scriptlet defined by the extension author. The scriptlet is part of AdGuard's open-source scriptlet library that other ad blockers also ship. The text has been corrected. This article has also been updated to reflect a static review of version 7.2.3.
