Tools by TUNGMMO

The extension declares host permissions for http://127.0.0.1/* and http://localhost/* despite being a YouTube ad-blocking tool with no legitimate reason to communicate with localhost. These permissions allow the extension to make cross-origin requests to any locally running service, including local web servers, dev tools, or other installed software, enabling data exfiltration via a local proxy or interaction with locally running malware components.

{  "host_permissions": [    "https://youtube.com/*",    "https://*.youtube.com/*",    "http://127.0.0.1/*",    "http://localhost/*"  ]}

The internal extension settings page (index.html) contains an spm_prefix meta tag with value 333.1007, which is a Taobao/Alibaba SPM (Source Point Moment) affiliate tracking identifier used in Taobao and AliExpress web properties. Its presence in a Vietnamese YouTube tools extension strongly suggests the page template was lifted from an Alibaba e-commerce property, or the extension is designed to impersonate or ride Alibaba's affiliate network. The no-siteapp and no-transform Cache-Control directives also mirror exactly what Alibaba pages use to prevent mobile app interception — these have no meaningful purpose inside an extension page.

<meta name="renderer" content="webkit" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><meta name="spm_prefix" content="333.1007" /><meta name="referrer" content="no-referrer-when-downgrade" /><meta name="applicable-device" content="pc" /><meta http-equiv="Cache-Control" content="no-transform" /><meta http-equiv="Cache-Control" content="no-siteapp" />

A content_security_policy directive specifying 'unsafe-inline' for scripts has been embedded inside the content_scripts array entry, which is not a valid location for this directive in Manifest V3. While Chrome ignores it here, the attempt to declare unsafe-inline for extension pages signals an intent to execute inline scripts, which is a well-known vector for code injection attacks. If this CSP were to apply, it would permit dynamically constructed inline scripts with no integrity validation.

{  "content_scripts": [    {      "matches": [        "https://youtube.com/*",        "https://*.youtube.com/*"      ],      "js": [        "content.js"      ],      "content_security_policy": {        "extension_pages": "script-src 'self' 'unsafe-inline'; object-src 'self'"      }    }  ]}

The extension uses chrome.scripting.executeScript to inject a function directly into an active YouTube tab on user interaction. While the injected function (YTB_blockAD) appears benign, the pattern of dynamically injecting arbitrary JavaScript into privileged page contexts via the scripting API is a high-risk code injection vector. This capability could be trivially repurposed in a future update to inject credential harvesting, DOM modification, or data exfiltration code into YouTube sessions.

if ($("#blockads").prop("checked")) {  chrome.scripting.executeScript({    target: {      tabId: tab.id    },    function: YTB_blockAD,  });}...function YTB_blockAD() {  (function() {    const defined = (v) => v !== null && v !== undefined;    const timeout = setInterval(() => {      const ad = [...document.querySelectorAll(".ad-showing")][0];      if (defined(ad)) {        const video = document.querySelector("video");        if (defined(video)) {          video.currentTime = video.duration;        }      }    }, 500);    return function() {      clearTimeout(timeout);    };  })();}

Both popup.html and index.html load Bootstrap CSS from an external CDN (cdn.jsdelivr.net) at runtime. Although an SRI integrity hash is provided, loading resources from external infrastructure inside an extension creates a dependency on third-party availability and trustworthiness. A compromised CDN or MITM at the CDN edge could serve a malicious stylesheet that exploits CSS-based data exfiltration techniques or loads additional content.

<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet"  integrity="sha384-T3c6CoIi6uLrA9TneNEoa7RxnatzjcDSCmG1MXxSR1GAsXEV/Dwwykc2MPK8M2HN" crossorigin="anonymous" />