Adblock for YouTube Chrome Extension Vulnerable to Arbitrary JavaScript Execution
Disable or uninstall the Adblock for YouTube extension and replace it with a vetted alternative to eliminate arbitrary JavaScript execution.
Disable or uninstall the Adblock for YouTube extension and replace it with a vetted alternative.
Summary
The Adblock for YouTube Chrome extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) boasts more than 10 million installs and a Featured badge on the Chrome Web Store. Island researchers discovered that the extension can execute arbitrary JavaScript code, enabling attackers to inject malicious scripts into the user's browser. The vulnerability arises from insufficient input validation in the extension's background scripts, allowing an attacker to run arbitrary code with the extension's privileges.
Because the extension is widely used, the flaw presents a high‑impact vector for phishing, credential theft, or malware delivery. The discovery highlights the risks of third‑party extensions that claim to block ads but expose users to code execution attacks. Immediate action is required to mitigate the threat posed by this popular ad‑blocking tool.
Key changes
- Adblock for YouTube extension ID cmedhionkhpnakcndndgjdbohmhepckk
- Over 10 million installs and Featured badge on Chrome Web Store
- Extension allows users to prevent web…
- Arbitrary JavaScript execution vulnerability discovered by Island
- Potential for malicious code injection via extension
- Extension's code can be exploited to run arbitrary scripts