Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

Security researchers have discovered a concerning vulnerability in a popular Chrome extension that boasted over 10 million installations and a Featured badge on the Chrome Web Store. The extension, "Adblock for YouTube," was found to contain a dormant capability that could potentially execute arbitrary JavaScript code, presenting a significant security risk to its massive user base.

The discovery, made by security firm Island, revealed that despite the extension's legitimate functionality of blocking advertisements on YouTube, it contained underlying code capable of script injection. This means the extension could theoretically be manipulated to execute malicious code on users' browsers without their knowledge or consent. The extension, identified by the ID cmedhionkhpnakcndndgjdbohmhepckk, appears to have maintained its popularity and Google's Featured status despite this concerning capability.

This discovery affects the more than 10 million users who have installed the extension, potentially exposing them to various security threats including credential theft, session hijacking, or malware installation. The situation is particularly alarming given that many users trust extensions with Google's Featured badge as having undergone additional vetting. The extension's widespread adoption and trusted status make it an attractive target for threat actors who might seek to exploit its capabilities.

For security teams, this incident highlights the ongoing challenge of managing browser extension risks in enterprise environments. Even extensions that appear legitimate and widely adopted may contain hidden functionalities that could be weaponized. Organizations should consider implementing strict extension policies, regular audits of installed extensions, and solutions that can detect suspicious behavior from browser extensions. This case also emphasizes the importance of continuous monitoring of all software with access to corporate systems, regardless of their perceived trustworthiness.

The discovery of this dormant script injection capability in a heavily utilized extension serves as a reminder that security cannot be