Featured Chrome Ad Blocker with 10M+ Installs Carries Dormant JS Injection Capability

A Chrome extension marketed as "Adblock for YouTube" — listed under ID cmedhionkhpnakcndndgjdbohmhepckk and carrying Google's Featured badge — ships with code paths capable of fetching and executing arbitrary JavaScript on pages the user visits, according to analysis from enterprise browser vendor Island.

The extension has more than 10 million installs.

That install base, combined with the Featured trust signal, is what makes this notable. Capability is not the same as intent. But a dormant remote-script-execution primitive in a widely deployed extension is precisely the pattern abused in past Chrome Web Store supply-chain incidents, including the Cyberhaven compromise late last year and earlier campaigns where benign extensions were sold or updated into spyware.

Island's writeup describes the extension's ability to run arbitrary JS as latent — present in the code, but not observed delivering a malicious payload at the time of analysis. That distinction matters. A clean current build can be flipped by a single update push if the publisher account is sold, phished, or coerced. The Chrome Web Store's auto-update model means rollout is effectively instant for the install base.

There is no public attribution here, and none should be inferred. The activity does not, on the available evidence, overlap with any tracked cluster — not the financially motivated extension-hijack operators documented in the Cyberhaven intrusion, nor the broader "malvertising-to-extension" pipeline that Google's TAG and others have flagged over the past two years. Treat this as capability disclosure, not a campaign.

The relevant TTPs to watch, regardless of who owns the extension today:

• Remote configuration endpoints that return executable code rather than data.
• Conditional execution gated on geography, install age, or user-agent — common evasions to defeat sandbox review.

For defenders, the practical mitigations are familiar. Enterprise environments should enforce extension allowlisting via Chrome policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist), and consider blocking extensions that declare broad host permissions or scripting API access without a clear business case. Google's own guidance on enterprise extension management is documented at chromeenterprise.google.

Individual users who installed the extension should remove it until the publisher clarifies why the remote-execution path exists. The Chrome Web Store reporting form is the appropriate escalation channel for suspected policy violations.

The larger question — how a Featured-badge extension passed review with this primitive intact — is one for Google. Featured status is supposed to signal a higher trust bar around "technical best practices and a high standard of user experience," per the Chrome Web Store developer documentation. Dormant remote code execution does not obviously meet that bar.

Medium confidence the extension's current build is non-malicious. Low confidence that remains true across future updates.