YouTube ad blocker with 11 million installations found to have potential backdoor for arbitrary code injection (heise.de)

• Over 11 million installations
• Server can inject JavaScript into any page
• No concrete abuse observed
• Developer removes the function and updates the extension

"Security researchers at island.io discovered that the Chrome extension 'Adblock for Youtube' (over 11 million installs) can inject arbitrary JavaScript code into any visited page via server configuration. No malicious use was observed, but the risk is significant. The developer is removing the vulnerable function."