CVE-2026-19986
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability was identified in the Adblock for Youtube Extension up to version 7.2.1 on Chrome. The issue affects the updateDynamicRules function in the file contentscript.js of the Event Listener component. Manipulation of the yt-anti-adblock-detected argument causes improper authorization. The attack can be initiated remotely, and the exploit is publicly available.
Risk Assessment
An attacker could exploit the vulnerability to bypass authorization, potentially leading to unauthorized actions within the extension or browser context.
Recommendation
Update the extension to the latest version that addresses the vulnerability, and consider temporarily disabling the extension until updated.
Original NVD description (English source)
A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.