- The popular “Adblock for YouTube” Chrome extension now carries an architectural weakness that could allow remote JavaScript execution.
- Security researchers say the extension records 11 million+ installations and now requests permission to access every website its users visit.
- According to reports, bad actors have not exploited the flaw, but could enable abuse without the need for an update.
Security researchers at a security firm named Island just found a loophole in the Adblock for YouTube Chrome extension and raised the alarm early. According to the researchers, they found no evidence that the loophole is maliciously used.
However, they argue that the architecture of the extension introduces a significant security risk. Soon, threat actors could harness server-side configuration changes alone.
Remote Configuration Raises Security Concerns
Island’s researchers discovered that the extension communicates daily with a remote server, api.adblock-for-youtube.com, to download updated configuration files.
It is common to have remote rule updates among ad-blocking extensions. However, these configuration files include “scripletsRules,” which determine which built-in JavaScript components (scriptlets) the extension executes and incoming parameters.
These rules originate from a remote server rather than inside the extension itself. Thus, researchers say the behavior of the extension could theoretically morph. As such, it may not require users to install a new version or undergo Google’s Chrome Web Store review process.
Remote exploitation vectors are increasingly being commercialized, the FBI has warned about ‘Kali365,’ a subscription service that enables attackers to remotely compromise Microsoft 365 accounts.
Extension Requests Broad Website Access
Another concern raised by Island involves the permissions the extension requests. Adblock for YouTube advertises itself as a tool specifically for YouTube. However, it requests Chrome permissions to access every website a user visits.
The researchers say the extension activates by checking if a webpage’s URL contains the text “youtube.com.” They found that this process does not actually verify the website’s domain.
Instead, any URL containing the text “youtube.com” anywhere within it (including inside a query parameter) passes the extension’s check.
Researchers argue that a YouTube-focused tool should instead restrict execution exclusively to YouTube domains and embedded players rather than browser-wide access.
Researchers Demonstrate Proof-of-Concept
To demonstrate the potential risk, Island conducted a proof-of-concept test without modifying the extension itself. As such, they configured a local server to deliver a modified configuration file while keeping the installed extension unchanged.
During the demonstration, the extension first injected JavaScript while the user visited YouTube. The researchers then opened a Salesforce URL that simply contained the text “youtube.com” within one of its query parameters.
The extension relied only on a string match rather than validating the actual domain. So, it also executed its script on the Salesforce page. The proof-of-concept showed the injected code accessing information available through the authenticated Salesforce session before reverting to the researchers.
The demonstration illustrates how insufficient domain validation and remotely controlled scripting behavior could potentially expose users to risks over time.
Island also examined the extension’s development history as far back as 2014. It has links to Adblock for Chrome and Adblock for You, two extensions Google’s Chrome Web Store flagged as “malware.”
These historical observations do not indicate current malicious activity. However, Island says they reinforce the importance of closely evaluating browser extensions that request broad permissions over users’ browsing activity.
The researchers stress that organizations and users regularly review installed browser extensions, limit unnecessary permissions where possible, and remove software that requests broader access than its intended functionality requires.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Google and FBI Disrupt NetNut Residential Proxy Network Used by 2M+ Devices
Google worked with the FBI and Lumen to disrupt the NetNut residential proxy network, also known as ...
Opera Launches Paste Protect to Block ClickFix Clipboard Attacks
Opera’s Paste Protect blocks harmful commands from reaching the clipboard, preventing ClickFix...
Reddit Introduces Mandatory Age Verification for EU Teens Accessing NSFW Content
Reddit will require European Union users under 18 to verify their age before viewing mature or NSFW ...
Texas Hunting and Fishing License Data Breach Affects 3 Million Customers
Approximately 3 million Texas hunting and fishing license customers were affected by a data breach i...
FBI Warns of ‘Kali365’ Subscription Service Targeting Microsoft 365 Accounts
The FBI’s sounding the alarm on Kali365, a site where criminals can pick up ready-to-use tools for s...
Cybercriminal Claims Leak of Internal Visa Systems, but No Customer Data Exposed
A cybercriminal claims they have internal Visa system details, including authentication flows and AP...
