Popular Chrome ad-block extension found to allow remote script injection

Colleagues, a cybersecurity alert: the Adblock for YouTube extension (10M+ installs) contains a mechanism potentially enabling remote insertion and execution of JavaScript on any site.

Key facts:
• Researchers at Island discovered a "trusted-create-element" pathway that permits creating via server configuration.
• The capability was inactive during analysis but can be enabled without updating the extension or store review.
• The extension requests access to all sites; its restriction to "youtube.com" can be trivially bypassed by URL substitution.

Why it matters: remotely controlled injection can lead to data exfiltration and session compromise.

What extension-auditing practices do you use?

#cybersecurity #browserSecurity #extensions #privacy