Adblock for YouTube Extension Exposes 11 Million Users to JavaScript Injection Risks

www.island.io

Adblock for YouTube Extension Exposes 11 Million Users to JavaScript Injection Risks

First seen 26 Jun 2026, 10:37 UTC • •67.5

Article Content

1 / 3

Browse articles

ThreatCluster •June 27, 2026 at 09:58 UTC

•Adblock for YouTube has dormant JavaScript injection capabilities that can be activated remotely.
•Over 11 million users are potentially at risk due to the extension's broad permissions.
•No malicious activity has been observed yet, but the risk of data theft is significant.

The Adblock for YouTube Chrome extension, with over 11 million installs, has been found to contain dormant JavaScript injection capabilities that could be activated by a single server-side change. This vulnerability allows unauthorized code execution without user knowledge, potentially compromising sensitive data across various sites. The extension's permissions enable it to inspect requests and manipulate page content, posing a significant risk to users, including those in enterprise environments. No malicious payloads have been observed yet, but the potential for exploitation remains high. The extension has been in the Chrome Web Store since 2014 and has a history of ownership changes and malware removals. Security researchers recommend caution when using extensions with broad permissions.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 134d ago How this analysis works

Timeline

2026-06-26

Dormant JavaScript injection capabilities discovered

Island security researchers found that Adblock for YouTube could execute unauthorized JavaScript on user devices without their knowledge.

2026-06-26

Extension's permissions allow for potential exploitation

The extension's design permits it to manipulate page content and interact with user sessions, posing a risk to sensitive data.

More articles in this cluster (2)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Zero-day Exploit
T1059.007 - JavaScript

Organization (2)

Salesforce
YouTube

Affected Platform (1)

Chrome Web Store

Relationships

Malware targets Chrome Web Store
Zero-day Exploit targets Chrome Web Store
T1059.007 - JavaScript targets Chrome Web Store
Malware related to Salesforce
Malware related to YouTube

Following this threat?

Track Salesforce in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Volt Typhoon's Silent Train Network Targets US Critical Infrastructure The Chinese state-sponsored hacking group Volt Typhoon has been linked to a covert network called Silent Train, which has exploited at least four zero-day vulnerabilities over three years. This network utilizes rapidly rotating chains of compromised SOHO routers, IoT devices, and enterprise infrastructure to access…

GitLab Issues Emergency Patch for Critical RCE Vulnerability GitLab has released emergency patches for a critical remote code execution vulnerability, CVE-2026-97229, affecting its Community and Enterprise Editions. This flaw, stemming from an integer overflow in the CI/CD regular expression compiler, allows unauthenticated attackers to execute arbitrary code via specially…