Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

Summary: Island's analysis found that the Chrome extension Adblock for YouTube, with more than 10 million installs and a Featured badge, contains the architectural capability to execute arbitrary JavaScript on any website, activated by a single server-side configuration change without an extension update or store review. The extension has been on the Chrome Web Store since 2014, changed ownership four years later, shipped an ad-injection SDK called Unistream SDK until June 2024, and at the time of analysis validated youtube.com by string match anywhere in the URL rather than by hostname.
Key Takeaway: A single server-side configuration change could turn a 10-million-install extension with all-site access into a tool for reading pages, stealing data, and acting as the user inside personal accounts, work apps, and admin panels, with no update and no visible sign that anything changed.

Read the original at The Hacker News ↗