Featured Chrome Ad Blocker with 10M+ Installs Carries Dormant JS Injection Capability

Key points

• A Chrome extension called "Adblock for YouTube" (ID: cmedhionkhpnakcndndgjdbohmhepckk) can fetch and execute arbitrary JavaScript on pages the user visits.
• The extension carries Google's Featured badge and has more than 10 million installs.
• Island's analysis found the capability dormant: present in the code, but not observed delivering a malicious payload.
• A single update push can activate a dormant primitive if a publisher account is sold or phished, and Chrome's auto-update model makes rollout effectively instant.
• No tracked threat cluster maps to this extension on current evidence; treat this as capability disclosure.

What did researchers actually find?

Island, an enterprise browser vendor, found that the extension can run arbitrary JavaScript as a latent feature: present in the code, not yet weaponised. That distinction matters, though it doesn't settle the risk. Capability is not intent, but a dormant remote-script-execution primitive in a widely deployed extension is precisely the pattern abused in past Chrome Web Store supply-chain incidents, including the Cyberhaven compromise in late 2024 and earlier campaigns where benign extensions were sold or updated into spyware.

This is the third Chrome-related story we've reported in the last 90 days, and the pattern is consistent: the browser's extension trust model keeps getting stress-tested from directions review processes weren't built to catch.

Should you be worried about the Featured badge?

Yes, and specifically because of it. Featured status is supposed to signal adherence to "technical best practices and a high standard of user experience," per the Chrome Web Store developer documentation. Dormant remote code execution doesn't obviously meet that bar. The larger question of how this primitive passed review is one for Google to answer publicly.

There's no public attribution here, and none should be inferred. The activity doesn't, on available evidence, overlap with any tracked cluster: not the financially motivated extension-hijack operators documented in the Cyberhaven intrusion, nor the broader malvertising-to-extension pipeline that Google's TAG and others have flagged over the past two years.

What should defenders do now?

Enterprise environments should enforce extension allowlisting via Chrome policy (ExtensionInstallAllowlist and ExtensionInstallBlocklist), and block extensions that declare broad host permissions or scripting API access without a clear business case. Google's enterprise extension management guidance lives at chromeenterprise.google.

Two TTPs worth monitoring regardless of who owns this extension today: remote configuration endpoints that return executable code rather than structured data, and conditional execution gated on geography or install age, both are common evasions against sandbox review.

Individual users who installed it should remove it until the publisher explains why the remote-execution path exists. The Chrome Web Store reporting form is the right escalation channel for suspected policy violations.

Medium confidence the current build is non-malicious. Low confidence that holds across future updates.