Executive brief
Adblock for Youtube is a Chrome extension that blocks advertisements on YouTube. A vulnerability in version 7.2.1 allows any script running on a YouTube page (or another extension) to permanently disable the ad-blocking feature by sending a forged DOM event. This undermines the core protection that users rely on and could be exploited by websites to bypass ad filtering.
Technical details
The vulnerability is an improper origin validation in the content script's DOM event listener (CWE-346). The vulnerable function updateDynamicRules in contentscript.js listens for a hard-coded DOM event named "yt-anti-adblock-detected" without validating the event's origin or authenticity. When triggered, it sets ads=false in the extension's chrome.storage.local, causing the background script to remove ad-blocking Declarative Net Request (DNR) rules. The attack is network-accessible and requires no user interaction or authentication—any page script or co-installed extension can dispatch the synthetic event to persistently disable ad blocking. The vendor has confirmed the issue and indicated a fix is planned but requires coordinated changes in both the extension and anti-adblock detection logic.
Affected products
- AdBlock Ltd. Adblock for Youtube up to 7.2.1
Timeline
- 2026-08-17: disclosed