BadBlocker: 11M Users, One Server Call Away from Compromise
A critical vulnerability in the BadBlocker ad-blocking app for Apple devices could have let attackers remotely execute code and take full control of devices via a single server request. The flaw affected up to 11 million users. The developer has since released a fix.
Background
- Island is a "enterprise browser" company — it sells a hardened, Chromium-based browser (the Island Browser) that corporations deploy to employees to enforce security policies at the browser level, rather than relying on VPNs or agent software.
- BadBlocker was a content-blocking browser extension (ad/tracker blocker) with 11 million users on Chrome Web Store, targeted at Russian-speaking users (e.g., blocking Yandex ads, VK trackers).
- The extension's server sent back a "blocklist" URL that was hardcoded as HTTP (not HTTPS) and pointed to a domain whose registration had lapsed. Any attacker who re-registered that domain could serve malicious blocklists to all 11 million users, gaining full read/write access to every website those users visited.
- The flaw highlights a common pattern: browser extensions with large userbases that rely on insecure update channels or unsecured remote resources, turning them into a single point of compromise.