Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability

**Adblock for YouTube**, a Chrome extension with over 10 million installs, was found to include a remote-controlled script-injection capability (a dormant "trusted-create-element" rule) that could enable arbitrary JavaScript execution on any site via a server-side change without an update or store review, posing significant risk to user data and sessions despite no observed active exploitation.