Right now, 11 million people have a Chrome extension installed

Right now, 11 million people have a Chrome extension installed that can be remotely switched into a tool that reads your email, your bank, your work accounts. Google knows about it and it's not been removed. The extension is called Adblock for YouTube. It does what it says. But security researchers just proved that with one change on the developer's server. No update, no warning, no way to see it happening. It can silently run code on every single website you visit and send your data wherever they want. They didn't just theorise it, they built a proof of concept. They used it to pull data from a live Sales Force account through a normal browsing session. And it works. Now this gets a bit darker than this. This isn't new. This is a tale as old as time. Three extensions connected to the same developer have already been removed from the Chrome store for malware. The Great Suspender, once trusted by millions, was quietly sold to an anonymous buyer who pushed malware through it before Google pulled it. PDF Toolbox, 2 million installs, hidden script injection. Cyberhaven, a legitimate security company's own extension, got hijacked and pushed malicious code to 400,000 users overnight. Every single time the extensions looked legitimate. Good reviews, high install counts, official store badges and every single time Chrome's vetting missed it until it was too late. Adblock for YouTube changed ownership in 2018. Nobody noticed. It went from thousands of users to 11 million. The hidden capability has been sitting there since at least February 2025. Google hasn't removed it. As of today, it still has its featured badge. So here's what to do. Go to your Chrome extensions right now. If Adblock for YouTube is there, remove it. Replace it with uBlock Origin if that still works. That's not even there anymore. Look, just essentially use a browser with an adblocker. Firefox is probably quite good. Hello Firefox if you're there. And start treating browser extensions the same way you treat apps because they have the same access and nowhere near the same scrutiny. Follow me. Everyday there's been a story like this. It's bad times.