CVE-2026-19986— Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | Adblock for Youtube Extension | 7.2.0 | affected |
7.2.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19986
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Adblock for Youtube Extension Event Listener contentscript.js updateDynamicRules improper authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in Adblock for Youtube Extension up to 7.2.1 on Chrome. The impacted element is the function updateDynamicRules of the file contentscript.js of the component Event Listener. This manipulation of the argument yt-anti-adblock-detected causes improper authorization. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Adblock for Youtube Extension | 7.2.0 | cpe:2.3:a:adblock_for_youtube_extension:adblock_for_youtube_extension:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19986
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19986
请登录查看更多情报信息。
Security Blog Posts for CVE-2026-19986 (1)
Same Patch Batch · n/a · 2026-08-17 · 15 CVEs total
| CVE-2026-19965 | 3.7 LOW | automad Password Reset Endpoint UserController.php requestPasswordResetToken response disc |
| CVE-2026-51346 | StudIP 6.0.3前/5.4.12前SQL注入漏洞 | |
| CVE-2026-50769 | Brainformatik CRM+ <2025.6 SQL注入漏洞 | |
| CVE-2026-50771 | Squirro Cognitive Search <3.14.2 存储型XSS漏洞 | |
| CVE-2026-50768 | ImageMaster 9.14.2.8.1文件上传漏洞可致远程代码执行 | |
| CVE-2026-50770 | Squirro Cognitive Search <3.14.2 提权漏洞 | |
| CVE-2026-50772 | Squirro <3.14.2 密码重置远程代码执行漏洞 | |
| CVE-2026-50775 | DataHub 1.5.0.1盲注SSRF漏洞 | |
| CVE-2026-50776 | Pronis Loisirs Billetterie CSE目录遍历漏洞 | |
| CVE-2026-50773 | CGM ISIS MED 2510.1.0.20远程代码执行漏洞 | |
| CVE-2026-50774 | GAPTEQ Designer v3.5公司经理角色权限提升漏洞 | |
| CVE-2026-67678 | DocSys v2.02.80任意代码执行漏洞 | |
| CVE-2026-68004 | SRS <5.0.213远程代码执行漏洞 | |
| CVE-2026-68005 | mini_httpd <1.30拒绝服务漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-285
- CVE-2026-16879
IBM Db2 Mirror for i is affected by multiple vulnerabilities - CVE-2026-73421
NextAuth.js: Configuration errors can cause existence-based - CVE-2026-18509
IBM i is Affected By A Prvilege Escalation Vulnerability [] - CVE-2026-73644
OpenDJ: Authorization bypass in SASL PLAIN allowing a `proxi - CVE-2026-3835
Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 -
V. Comments for CVE-2026-19986
No comments yet