Later archive addition

Adblock Plus filter lists may execute arbitrary code in web pages

The article shows how Adblock Plus’s `$rewrite` option let filter-list maintainers redirect Fetch or XHR code loads through same-origin open redirects, enabling arbitrary JavaScript execution in affected pages. It documents the affected extensions, Google-service examples, and mitigations including CSP and removal of the feature.

Record

Date

15 April 2019

In the archive

• Added to the 2019 archive after the original list was published

Tags

• browser-extension
• supply-chain
• code-injection
• javascript
• open-redirect
• csp
• attack-chain
• cve
• owasp-a04-2021
• owasp-a05-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.