CVE-2026-19986
Received Received - Intake

Improper Authorization in Adblock for YouTube Extension

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19986
EUVD
EUVD-2026-60048

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
adblock_ltd adblock_for_youtube to 7.2.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Adblock for Youtube Chrome extension up to version 7.2.1. It involves the function updateDynamicRules in contentscript.js which improperly handles the 'yt-anti-adblock-detected' event. This allows unauthorized modification of the extension's ad-blocking rules, effectively disabling its core functionality without proper authorization.

Detection Guidance

Check for the presence of the Adblock for Youtube extension version 7.2.1 or earlier. Inspect Chrome browser extensions for the 'yt-anti-adblock-detected' event listener in contentscript.js. Monitor for unauthorized DOM events triggering this specific event name on YouTube pages.

Impact Analysis

This vulnerability allows any script or extension with access to YouTube pages to permanently disable the ad-blocking feature. This means you may see ads on YouTube even with the extension installed. It undermines the extension's privacy and security protections but does not lead to account takeover or arbitrary code execution.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it does not involve unauthorized data access, disclosure, or processing of personal health information. However, it undermines the extension's core privacy functionality by allowing unauthorized persistent disabling of ad-blocking, which could expose users to tracking or unwanted content.

Mitigation Strategies

Update the Adblock for Youtube extension to the latest version if available. Remove the extension if no update is provided. Disable the extension's ability to listen for the 'yt-anti-adblock-detected' event by inspecting and modifying its code if possible. Use alternative ad-blocking methods that are not affected by this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19986. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart