An analysis of a popular Google Chrome ad block extension for YouTube has uncovered the ability to execute arbitrary JavaScript code.
According to Island, the extension, named Adblock for YouTube (ID: cmedhionkhpnakcndndgjdbohmhepckk), has more than 10 million installs and carries a Featured badge on the Chrome Web Store.
The extension description states that it allows users to prevent web page elements like ads, including preroll ads, from being displayed on the video sharing platform, as well as on external sites that load YouTube. While the add-on offers the promised functionality, it also features capabilities to run arbitrary JavaScript code.
“It also contains the architectural ingredients for arbitrary JavaScript execution on any website, activated by a single server-side configuration change, without an extension update, without a store review, and without any visible sign that something has changed,” researchers Oleg Zaytsev and Shachar Gritzman said in a report shared with The Hacker News.
“In practical terms, that could mean reading pages, stealing data, and acting as the user inside personal accounts, work apps, admin panels, and other sensitive browser sessions.”
It’s worth emphasizing here that there is no evidence malicious payload has been distributed to users in this manner, but the mere presence of the capability, coupled with ties to other ad-blocking extensions that have since been removed from the storefront for malware, raises privacy and security risks, Island added.
The list of related extensions that have been taken down is listed below –
- Adblock for Chrome (ID: onomjaelhagjjojbkcafidnepbfkpnee)
- Adblock for You (ID: ogcaehilgakehloljjmajoempaflmdci)
- AdBlock Suite (ID: gekoepiplklhniacchbbgbhilidiojmb)
Adblock for YouTube has been on the Chrome Web Store since 2014, starting off as a basic YouTube ad blocker before it changed ownership four years later. Early iterations of the extension were found to ship with an ad-injection software development kit (SDK) named Unistream SDK, although it was removed in June 2024.
What’s been constant is the presence of remote-controlled script injection paths since February 2025, opening the door to the creation of arbitrary “