A Chrome ad-blocking extension masquerading as a straightforward tool for YouTube is exhibiting the capability to execute arbitrary JavaScript code on any website visited by its users, all without triggering an update or a store review. Security researchers at Island have identified that the extension, Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk), which boasts over 10 million installs and a Featured badge on the Chrome Web Store, contains a dormant mechanism that could be activated by a single server-side configuration change.
The Architecture of a Silent Script Injection
The core issue lies in the extension’s ability to create arbitrary <script>codecodecodecode elements using a bespoke scriptlet rule named “trusted-create-element,” defined by the extension author. This rule, which is currently dormant and not active in the server response, provides a path for injecting malicious code. “Activating it requires a single server-side change, no extension update, no store review,” explained researchers Oleg Zaytsev and Shachar Gritzman. This means that without any visible change to the user or any new code pushed through the Chrome Web Store’s review process, the extension could be weaponized to read page data, steal credentials, or perform actions on behalf of the user across personal accounts, work applications, and admin panels.
While there is no current evidence that a malicious payload has been distributed, the mere presence of this dormant capability raises significant privacy and security concerns. This is especially alarming given the extension’s historical ties to other ad-blocking tools that were removed from the Chrome Web Store for malware. The list of related, now-removed extensions includes Adblock for Chrome, Adblock for You, and AdBlock Suite.
Beyond YouTube: A Permissions Problem
The risk is compounded by the fact that, despite its name, the extension operates on every website a user visits. It includes a check that theoretically limits its activity to pages containing “youtube.com,” but this check is trivial to bypass. It only verifies if the string “youtube.com” appears anywhere in the URL, without validating the hostname, frame origin, or embedded player context. This means an attacker could craft a URL like bank.example.com/search?q=youtube.comcodecodecodecode or internal.corp.com/redirect?from=youtube.comcodecodecodecode to bypass the check and allow the script injection to run on banking or corporate sites.
Adblock for YouTube has been on the Chrome Web Store since 2014 and underwent a change in ownership four years later. Early versions contained a known ad-injection SDK called Unistream SDK, which was removed in June 2024. However, the remote-controlled script injection paths have been present since February 2025. The combination of a high-install extension with broad all-site permissions, a remote-controlled injection path, prior ad-injection infrastructure, a major ownership change, and links to removed malware-adjacent extensions creates a particularly dangerous threat profile.
How Does This Chrome Extension Threaten User Privacy?
The dormant script injection capability in Adblock for YouTube threatens user privacy by allowing a remote server to instruct the extension to run arbitrary JavaScript code on any webpage. This could be used to read the contents of a page, intercept form data (including passwords and credit card numbers), steal authentication tokens from cookies, and perform actions on behalf of the user within their banking, email, or corporate accounts. Because the capability is dormant and activated server-side, users would have no warning that their privacy has been compromised and no visible indicator that the extension is behaving maliciously.
A Broader Trend in Malicious Extensions
This discovery comes at a time when malicious browser extensions are becoming a more prevalent attack vector. Separately, Palo Alto Networks Unit 42 detected 18 browser extensions impersonating consumer brands, aiming to monetize through affiliate marketing fraud. These extensions would open a .shop domain in a new tab upon installation, redirecting users through a chain designed to push a gaming-oriented browser. This pattern underscores the importance of scrutinizing extension behavior and not relying solely on install counts or store badges as indicators of safety.
What Affected Users Should Do Now
If you have the Adblock for YouTube extension installed, the most immediate and effective action is to remove it from your browser. While the capability is currently dormant, the risk posed by its potential activation is not worth the convenience. Instead, consider using a robust, reputable standalone ad-blocking solution that operates with a clear and transparent privacy policy, or restrict extension permissions to only the sites they absolutely require. For users concerned about broader browser security, it is a prudent practice to regularly audit installed extensions, revoke permissions for any you do not fully trust, and enable two-factor authentication on all critical online accounts to mitigate the impact of potential credential theft. The fundamental security principle is clear: an extension that can do anything on any site, and can be instructed to do so from a remote server without your knowledge, is a liability, not a tool.
