Ten million people installed a Chrome extension that can rewrite any page they visit, and almost none of them know it.

That’s the uncomfortable takeaway from the latest analysis of “Adblock for YouTube,” a Chrome Web Store extension carrying a Featured badge and more than 10 million installs. Researchers at Island found it ships with the ability to execute arbitrary JavaScript in pages you load. The capability sat dormant. Dormant is not the same as harmless. This is a cybersecurity problem that lives entirely inside the browser, the one piece of software your users keep open all day and your perimeter tooling barely watches.

A Badge Is Not A Background Check

Here’s what makes extensions special, and dangerous. When a user grants “read and change all your data on websites you visit,” they hand a third party the keys to every web session on that machine. Banking. Email. Your internal admin consoles. The extension runs inside the page, after TLS terminates, after your firewall has already waved the traffic through as normal browsing.

An ad blocker asking for broad page access looks completely reasonable. Stripping ads means touching page content. So the permission grant doesn’t trip anyone’s instincts, and that’s the whole trick.

The Featured badge is the part that should sting. It reads like a vetting stamp, a signal that someone checked. What it actually certifies is that the extension followed Chrome Web Store policies at review time. Sleeper code doesn’t show up at review time. It waits for a server-side flag, a config push, or a quiet update to a new owner, and then it wakes up. You vetted a snapshot. You’re running a living thing that can change underneath you.

Your Tools Are Looking The Wrong Direction

Most defensive stacks were built to watch the network edge and the disk. Brute-force attempts against your VPN, malicious binaries hitting the filesystem, weird outbound connections. Good controls. None of them see a trusted extension injecting script into a page the user legitimately opened.

There’s no malware on disk. The code arrives through Google’s own update channel over HTTPS, which your proxy treats as routine. Threat detection that keys on file hashes or known-bad domains has nothing to grab onto. By the time an extension flips from benign to hostile, it’s already inside, already privileged, already trusted by every tool you own.

This is the same lesson that keeps showing up in different costumes. Defense in depth assumes any single layer can fail, and the browser is a layer almost nobody instruments. If your only answer to “what extensions are running across our fleet, and what can they do” is a shrug, you have an inventory gap, not a tooling gap.

What To Actually Do About It

The fix is governance, not panic. Browser extensions are software, and software running on corporate endpoints with session-level access deserves the same discipline you give any other install.

Start with the immediate moves, this week:

• Inventory what’s deployed. Pull the list of installed extensions and their permissions across your managed browsers. Enterprise browser management and most EDR platforms can report this. You cannot govern what you have never counted.
• Flag the broad-permission grants. Anything requesting “read and change all your data on all websites” goes on a review list. Match each one to a real business need and a known publisher.
• Kill the orphans. Extensions with no owner, no clear purpose, or a publisher who has gone quiet get removed. Sleeper code needs an install base to matter.

Then make it stick with ongoing controls. Enforce an allowlist through browser enterprise policy so users install from an approved set rather than the open store. Pin extensions to specific versions where your management layer supports it, so a silent update can’t swap the code without review. Watch for ownership transfers and sudden permission changes on extensions you already trust, because that handoff is exactly where a clean tool turns dirty. Feed browser extension telemetry into the same threat-protection pipeline that already watches your endpoints, and write extension compromise into your incident response runbook so the first question isn’t “can browsers even do that.”

Security hardening here is unglamorous and cheap. An allowlist, version pinning, and a quarterly review of permission grants will stop the overwhelming majority of this class of risk. None of it requires a new product. It requires deciding that the browser is part of your attack surface and treating it that way.

Ten million installs is a big blast radius for code that was only ever one config flag away from hostile. Assume the next one already cleared review too.

Sources

• Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability