uBlock, I exfiltrate: exploiting ad blockers with CSS
Summary: PortSwigger researcher Gareth Heyes found ways to bypass uBlock Origin's restrictions on its community filter lists, using CSS injection techniques to extract data from scripts and attributes and to steal passwords from Microsoft Edge when characters are unmasked via the eye icon. He reported the bypasses and a JavaScript URL injection flaw to uBlock Origin, which patched them between August and November 2021, with Heyes bypassing one patch hours after it landed.
What you should know: Ad blockers run on every page a user visits, so a compromised filter list turns a defensive tool into a data-exfiltration channel across every site that user opens - and uBlock Origin has no security contact, forcing disclosure through public GitHub issues.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026