Popular Chrome ad-blocking extension hides dangerous code

Security researchers at Island recently took a closer look at the extremely popular “Adblock for YouTube” tool. While the add-on reliably does its job and removes ads from the platform and external sites, its architecture hides a serious security risk. The code allows for remote scripting and execution on any website you visit.

Experts point out that in practice this means the possibility of reading the content of the page, stealing data and even managing personal and business accounts on behalf of the user. At the moment, there is no evidence that this vulnerability has already been abused for attacks. However, the mere existence of such a function, along with links to other removed programs, is a big enough reason for concern. The Chrome Store has recently removed related add-ons such as “Adblock for Chrome”, “Adblock for You” and “AdBlock Suite” due to malicious code.

The extension has been available in the official web store since 2014, but ownership changed four years later. Between 2018 and June 2024, it contained the Unistream SDK for “injecting” ads, and since February 2025, it has included mechanisms for launching external scripts. The tool uses the open-source AdGuard library with small functions called “scriptlets.” The problem arises because the server determines which of them will be launched. The “trusted-create-element” function can create an HTML element on a page, and if the server sends malicious code to it, it runs smoothly in the background. The researchers warn that this capability is currently dormant, but it can be activated with a single change on the developer’s server, without Google’s review or an update to the add-on itself.

An additional concern is that the extension works on all websites, as the URL security check is superficial. The code only checks if the string “youtube.com” exists anywhere in the address, meaning it can easily be fooled with addresses like bank.example.com/search?q=youtube.com or facebook.com/page?ref=youtube.com.

Following the public release of the report, Mathias Rochus, founder of AdBlock Ltd., responded. He assured that the features have never been abused and will not be abused, and announced an urgent update. This will fix the URL validation, which will now require an exact match of the YouTube host, and disable server-side script injection. The fix must be approved by Google before it can be released.