India, June 26 -- A Chrome ad blocker with more than 10 million installs has reopened an old browser security debate. The tool may work as promised, but researchers say its design leaves room for a much riskier outcome.

Security researchers at Island examined Adblock for YouTube, a Chrome extension listed under the ID cmedhionkhpnakcndndgjdbohmhepckk. The extension is built to block ads and page elements linked to YouTube videos. It also carries a Featured badge on the Chrome Web Store. The important point is balance. Island has not said that the extension delivered malicious payloads to users. The concern is that it reportedly contains a dormant route for remote JavaScript injection through a server-side configuration change. That means...