Security researchers at Island have identified dormant script injection capabilities within Adblock for YouTube, a popular Chrome extension with over 10 million installs. The extension, assigned the ID cmedhionkhpnakcndndgjdbohmhepckk on the Chrome Web Store, carries a Featured badge while harboring the ability to execute arbitrary JavaScript code.
The dormant functionality represents a significant latent threat, as it could be activated remotely to inject malicious scripts into any webpage a user visits. With a user base exceeding 10 million, the potential blast radius of an exploit is substantial, though Island has not reported active exploitation in the wild.
Technical analysis reveals that the extension's codebase includes mechanisms that would allow an attacker to push arbitrary JavaScript payloads to all installed instances. This means a single malicious update or configuration change could weaponize millions of browsers simultaneously, turning the ad blocker into a tool for credential theft, data exfiltration, or further malware delivery.
Users are advised to remove the extension immediately as a precautionary measure until the developer issues a patch explaining the purpose of the dormant code. Island has not confirmed whether Google has been notified regarding the Featured badge status, though the vulnerability has no associated CVE at this time.
No official attribution for the extension's developer or the dormant code's origin has been confirmed. The incident underscores a broader supply chain risk in browser extension ecosystems, where vetting processes may miss hidden capabilities in widely distributed software.