Security researchers at Island recently took a closer look at the extremely popular \u201cAdblock for YouTube\u201d tool. While the add-on reliably does its job and removes ads from the platform and external sites, its architecture hides a serious security risk. The code allows for remote scripting and execution on any website you visit.
Experts point out that in practice this means the possibility of reading the content of the page, stealing data and even managing personal and business accounts on behalf of the user. At the moment, there is no evidence that this vulnerability has already been abused for attacks. However, the mere existence of such a function, along with links to other removed programs, is a big enough reason for concern. The Chrome Store has recently removed related add-ons such as \u201cAdblock for Chrome\u201d, \u201cAdblock for You\u201d and \u201cAdBlock Suite\u201d due to malicious code.
The extension has been available in the official web store since 2014, but ownership changed four years later. Between 2018 and June 2024, it contained the Unistream SDK for \u201cinjecting\u201d ads, and since February 2025, it has included mechanisms for launching external scripts. The tool uses the open-source AdGuard library with small functions called \u201cscriptlets.\u201d The problem arises because the server determines which of them will be launched. The \u201ctrusted-create-element\u201d function can create an HTML element on a page, and if the server sends malicious code to it, it runs smoothly in the background. The researchers warn that this capability is currently dormant, but it can be activated with a single change on the developer\u2019s server, without Google\u2019s review or an update to the add-on itself.
An additional concern is that the extension works on all websites, as the URL security check is superficial. The code only checks if the string \u201cyoutube.com\u201d exists anywhere in the address, meaning it can easily be fooled with addresses like bank.example.com\/search?q=youtube.com or facebook.com\/page?ref=youtube.com.
Following the public release of the report, Mathias Rochus, founder of AdBlock Ltd., responded. He assured that the features have never been abused and will not be abused, and announced an urgent update. This will fix the URL validation, which will now require an exact match of the YouTube host, and disable server-side script injection. The fix must be approved by Google before it can be released.<\/p>","protected":false},"excerpt":{"rendered":"
Varnostni raziskovalci podjetja Island so nedavno pod drobnogled vzeli izjemno priljubljeno orodje “Adblock for YouTube”. Kljub temu, da dodatek zanesljivo opravlja svoje delo in odstranjuje oglase s platforme ter zunanjih strani, njegova arhitektura skriva resno varnostno tveganje. Koda namre\u010d omogo\u010da oddaljen prenos in izvajanje poljubnih skript na kateri koli spletni strani, ki jo obi\u0161\u010dete. Strokovnjaki […]<\/p>","protected":false},"author":2,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70],"tags":[440,478,482],"class_list":["post-7741","post","type-post","status-publish","format-standard","hentry","category-spletni-brskalniki","tag-chrome-brskalnik","tag-informacijska-varnost","tag-kibernetska-varnost"],"acf":{"subtitle":"","heading":"","summary":"Raziskava raz\u0161iritve \"Adblock for YouTube\" z 10 milijoni prenosov je razkrila spe\u010do funkcijo za oddaljen zagon zlonamerne kode na vseh spletnih straneh. Razvijalci podjetja AdBlock Ltd so po opozorilu \u017ee napovedali izdajo varnostnega popravka.","thumbnail_small":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2021\/03\/130321_ChromeRAM-560x315.jpg","thumbnail_large":"https:\/\/racunalniske-novice.com\/wp-content\/uploads\/2021\/03\/130321_ChromeRAM.jpg","thumbnail_caption":"Novi Google Chrome je precej prijaznej\u0161i do sistemskega pomnilnika!","gallery":"","video_gallery":null,"author":"","links":null,"sources":[{"title":"thehackernews","url":"https:\/\/thehackernews.com\/2026\/06\/chrome-ad-blocker-with-10m-installs.html?m=1"}],"skip_language":[]},"yoast_head":"\n