Executive Summary
Security researchers at Island discovered a critical dormant capability in the 'Adblock for YouTube' Chrome extension (11 million+ installs) that allows for arbitrary JavaScript execution via a single server-side configuration change. While no active malicious payload has been observed, the extension's architecture bypasses standard store reviews by fetching 'scripletsRules' from a remote API that can trigger MAIN-world script injection.
The threat is compounded by the extension's suspicious history, including ownership changes and infrastructure links to other ad-blockers previously removed from the Chrome Web Store for malware. The extension requests '<all_urls>' permissions despite its narrow purpose, and its internal validation for YouTube URLs is easily bypassed, placing enterprise SaaS, banking, and internal tool sessions at risk.
Organizations should treat this as a significant supply-chain risk. If activated, the dormant capability could allow attackers to steal session data, read sensitive page content, or perform actions as the authenticated user across all websites visited by the employee.