The vulnerability originates in the updateDynamicRules function of contentscript.js within the Adblock for Youtube Extension, allowing controlled manipulation of the yt-anti-adblock-detected argument. This flaw results in improper authorization, enabling an attacker to override or disable the extension’s ad-blocking behavior remotely. As the extension’s protection mechanism can be subverted, users may be exposed to ads, tracking, and potentially malicious sites without the intended filtration. The weakness aligns with CWE-266 (Least Privilege) and CWE-285 (Improper Authorization).

Adblock for Youtube Extension, any Chrome installation of version 7.2.1 or earlier. The documented vulnerability affects the extension in its up-to-7.2.1 release on the Chrome browser; later releases are not confirmed to be impacted.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack can be performed remotely through the event listener component, and public exploit code has been released, increasing the likelihood of real-world attacks. Exploitation requires the attacker to leverage the extension’s privileged event handling; thus, an active or compromised Chrome user would be a primary target.