Things I broke
BadBlocker
A popular Chrome ad blocker with 11 million users caught with dormant code-injection capabilities, one server call away from arbitrary compromise.
- 11M+
- Chrome users exposed
- <all_urls>
- broadest browser permissions
- 1 remote call
- away from arbitrary code injection
BadBlocker masqueraded as an innocent YouTube ad blocker with over 11 million installs from the Chrome Web Store. Underneath, it was polling a remote command-and-control server on every startup.
The extension possessed permissions to read and inject scripts into every page the user visited. A single malicious response from the C2 would execute arbitrary code across millions of browsers with zero user interaction.
In the press
The Hacker NewsChrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability GIGAZINEThe YouTube ad-blocking extension with 11M downloads could execute arbitrary JavaScript via server change SecurityBrief UKAdblock for YouTube extension flagged for security risk Cyber InsiderChrome extension Adblock for YouTube with 11 million users could be silently weaponized IT-ConnectAdblock for YouTube: 11 Million Installs and a Serious Security Flaw to Fix ICT Security MagazineBadBlocker: la vulnerabilità latente in Adblock for YouTube per Chrome heise onlineYouTube ad blocker with 11 million installations with possible backdoor BeEncryptedPopular ‘Adblock for YouTube’ Chrome Extension Found With Remote Code Execution Risk
The Chromium Security Paradox