A widely distributed YouTube ad blocker extension with over 10 million downloads can be abused through server-side configuration to execute arbitrary malicious code without evidence of active abuse to date.