CVE-2026-19986 - Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization

Back Back to CVE browser

MEDIUM

Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization

Published Aug 17, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.42%

Description

A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor Adblock for Youtube Extension Product Adblock for Youtube Extension Default
n/a
- Version
  7.2.0
  Status
  affected
  Constraints
  -
- Version
  7.2.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adblock for Youtube Extension

n/a

Version	Status	Constraints
7.2.0	affected	-
7.2.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-285

References (5)

https://github.com/xryj920/chrome_extensions/blob/main/AdBlock%20Ltd.%20Adblock%20for%20Youtube%207.2.1%20allows%20persistent%20disabling%20of%20ad%20blocking%20through%20an%20unauthenticated%20DOM%20event
exploitmedia-coverage
https://vuldb.com/cve/CVE-2026-19986
third-party-advisory
https://vuldb.com/submit/873935
exploitthird-party-advisory
https://vuldb.com/vuln/391190
vdb-entrytechnical-description
https://vuldb.com/vuln/391190/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/xryj920/chrome_extensions/blob/main/AdBlock%20Ltd.%20Adblock%20for%20Youtube%207.2.1%20allows%20persistent%20disabling%20of%20ad%20blocking%20through%20an%20unauthenticated%20DOM%20event		exploitmedia-coverage
https://vuldb.com/cve/CVE-2026-19986		third-party-advisory
https://vuldb.com/submit/873935		exploitthird-party-advisory
https://vuldb.com/vuln/391190		vdb-entrytechnical-description
https://vuldb.com/vuln/391190/cti		signaturepermissions-required