Featured Chrome Ad Blocker, 10M Installs, One Switch From Rogue

An ad blocker called Adblock for YouTube, sitting on the Chrome Web Store with a Featured badge and more than 10 million installs, has been quietly carrying the plumbing to run arbitrary JavaScript on any site its users visit. Researchers at Island found the capability dormant in the codebase, waiting on a single server-side switch. No update required, no review by Google, no notification to users.

The extension does what it says on the tin: it blocks YouTube ads. That is presumably why people install it. It also has permission to inspect and modify every page in the browser, which is normal for ad blockers and uncomfortable in this particular context.

The dormant capability

A custom scriptlet rule called trusted-create-element, present in the code since February 2025, lets the extension create script tags on the fly using instructions fetched from a remote server. There is a check meant to limit this to YouTube, but the check only looks for the string youtube.com anywhere in the URL. Drop that string into a path or a query parameter on any other site and the gate opens.

Island were careful to say they have not observed a malicious payload delivered through this channel. The point is not what has happened. The point is that the delivery channel exists, fully built, on ten million browsers.

A history that does not help

The provenance does some of the work here:

• The extension launched in 2014.
• It changed hands in 2018.
• It shipped an ad-injection SDK called Unistream until June 2024.
• It shares lineage with other ad blockers Google has since pulled from the store for malware.

None of these facts is damning on its own. Stacked together they describe an extension that could turn on its users at the convenience of whoever runs the server. Island's argument is not that something bad has happened. It is that something bad would be trivially easy to do.

The Featured badge problem

This is the part worth sitting with. Browser extensions are software you install with one click, granted broad permissions, and then largely forget about. The Chrome Web Store's Featured badge implies a level of vetting that, in practice, does not extend to dormant code that activates only when a remote server says so. Google reviews what is in the extension at submission. It does not review what the extension chooses to download later.

For anyone running a fleet of browsers in a business, the operational question is uncomfortable. You probably do not know which extensions your staff have installed, when they were installed, who currently owns the publisher account, or what those extensions are capable of doing the next time the developer pushes a config change. You have, in effect, outsourced a slice of your endpoint security to whoever bought the project on a forum five years ago.

A Featured badge is not a guarantee. Ten million installs is not a vote of confidence so much as a very large blast radius, and the people best placed to flip the switch are the ones least visible to the user.