A widely used Google Chrome ad-blocking extension for YouTube — installed on more than 10 million devices — has been found to contain the ability to run arbitrary JavaScript code on any website a user visits. The capability is currently dormant, but security researchers warn it could be switched on at any moment with a single change on the developer’s server, with no extension update and no Chrome Web Store review required.
The extension, named Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk), even carries a “Featured” badge on the Chrome Web Store — a mark that normally signals a level of trust and vetting. That makes the finding, reported by the browser security firm Island and shared with The Hacker News, all the more concerning.
What Researchers Found
According to Island researchers Oleg Zaytsev and Shachar Gritzman, the extension delivers its promised ad-blocking functionality, but it also contains what they describe as the architectural ingredients for arbitrary JavaScript execution on any site.
In their report, the researchers wrote that the extension “contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed.” In practical terms, they warned, that could mean reading pages, stealing data, and acting as the user inside personal accounts, work apps, admin panels, and other sensitive browser sessions.
Crucially, the researchers emphasized that the capability is dormant, not absent. At the time of their analysis, the injection mechanism — a bespoke scriptlet rule the extension author calls trusted-create-element — was not active in the server’s response. Activating it would require only a single server-side change on the developer’s end.
It’s worth stressing that there is no evidence any malicious payload has actually been delivered to users. The concern is the presence of the capability itself, combined with several surrounding red flags.
The Real Problem: A Bypassable “YouTube Only” Check
One of the most alarming findings is that, despite its name, the extension does not limit itself to YouTube. It runs on every website the user visits, then applies a check that is supposed to activate its behavior only on YouTube.
However, that check simply looks for whether the text “youtube.com” appears anywhere in the URL — it does not validate the actual hostname, frame origin, or embedded-player context. That means the check can be trivially bypassed by placing “youtube.com” anywhere in a web address. For example, all of the following would satisfy it:
www.facebook.com/page?ref=youtube.combank.example.com/search?q=youtube.cominternal.corp.com/redirect?from=youtube.com
In other words, a malicious actor could craft URLs that trigger the extension’s machinery on banking sites, corporate tools, or any other sensitive page — far outside YouTube.
A History That Adds to the Concern
Island’s thesis isn’t about a single suspicious line of code — it’s about a combination of factors that together raise the risk:
- The extension has been on the Chrome Web Store since 2014, starting as a basic YouTube ad blocker before changing ownership in 2018.
- Early versions shipped with an ad-injection SDK called Unistream SDK, which was removed in June 2024.
- The remote-controlled script-injection paths have been present since February 2025.
- Ad-blocker extensions typically request broad permissions to inspect requests and modify pages, giving this kind of capability wide reach.
- Several related extensions have already been removed from the Chrome Web Store for malware, including Adblock for Chrome, Adblock for You, and AdBlock Suite.
As Island put it, the concern is the combination: a high-install extension with all-site access, a remote-controlled injection path, prior ad-injection infrastructure, a major ownership and codebase change, and related extensions that were pulled for malware.
Why “Vulnerability” Isn’t Quite the Right Word
It’s important to frame this accurately. This is not a traditional vulnerability — a bug that an external attacker exploits against the software. Instead, it’s a latent capability under the developer’s control: the extension’s own author holds the ability to activate script injection remotely. The risk is one of trust and hidden capability rather than a patchable flaw. As the researchers summarized, users are effectively “one server call away from compromise.”
What Users Should Do
If you have Adblock for YouTube (ID cmedhionkhpnakcndndgjdbohmhepckk) installed, the most prudent step is to remove it until the situation is resolved, and consider a well-established, reputable ad blocker instead. More generally:
- Audit your installed extensions. Remove any you don’t actively use or don’t recognize, especially those with broad “read and change all your data on all websites” permissions.
- Scrutinize permissions. Be cautious about extensions that request all-site access, and question whether the stated purpose justifies it.
- Don’t rely on badges alone. A “Featured” badge or a large install count is not a guarantee of safety, as this case demonstrates.
For IT and security teams managing many users, this incident reinforces some standard practices:
- Implement strict extension policies — allow only vetted, essential extensions, ideally through an enterprise allowlist.
- Deploy endpoint and web-filtering controls that can detect and block suspicious script execution.
- Educate users about the risks of untrusted browser extensions.
- Monitor installed extensions continuously and be ready to remove any that show suspicious behavior or ownership changes.
Part of a Broader Trend
This disclosure lands alongside other recent extension-based threats. Palo Alto Networks’ Unit 42 recently reported 18 browser extensions impersonating consumer brands to monetize through affiliate-marketing fraud — extensions that, once installed, redirect users toward installing further software. Together, these cases underline how browser extensions have become an attractive attack surface: trusted by users, granted broad permissions, and capable of changing behavior after installation.
Final Thoughts
The discovery of a dormant script-injection capability inside a popular, “Featured” Chrome ad blocker is a sharp reminder that risk can hide inside seemingly trustworthy software — and that install counts and store badges are not proof of safety. The extension in question hasn’t been shown to have harmed anyone, but the combination of all-site access, a remote-controlled injection path, a bypassable safety check, and a history tied to ad injection and malware-removed siblings is exactly the kind of pattern worth taking seriously. If you use it, removing it is the safe call; and for everyone, this is a good prompt to review what your browser extensions can actually do.
Frequently Asked Questions
What exactly was found in the Chrome ad blocker extension?
Researchers at Island found that “Adblock for YouTube,” a Chrome extension with over 10 million installs, contains a dormant capability to inject and run arbitrary JavaScript on any website. It isn’t currently active, but it could be turned on with a single server-side change by the developer.
Is this a vulnerability that hackers can exploit?
Not in the traditional sense. Rather than a bug exploited by an outside attacker, it’s a latent capability under the extension developer’s control — effectively a backdoor that could be activated remotely. The risk is about trust and hidden capability, not a patchable flaw.
Has anyone actually been harmed by this?
There is no evidence that a malicious payload has been delivered to users. The concern is the presence of the capability combined with several red flags, including a bypassable safety check and ties to other extensions removed for malware.
Why is the extension’s “YouTube only” check a problem?
Despite its name, the extension runs on every site and only checks whether “youtube.com” appears anywhere in the URL — without verifying the real domain. That check can be bypassed by putting “youtube.com” anywhere in a web address, so the extension’s machinery can be triggered on sensitive sites like banking or corporate pages.
What should I do if I have this extension installed?
The safest step is to remove “Adblock for YouTube” (ID cmedhionkhpnakcndndgjdbohmhepckk) and switch to a reputable, well-established ad blocker. It’s also a good time to review all your extensions and remove any with broad permissions that you don’t actively need.
How can IT teams reduce this kind of risk?
Use strict extension allowlists, deploy endpoint and web-filtering security controls, educate users about extension risks, and continuously monitor installed extensions for suspicious behavior or ownership changes.