Improper Access Control in Eyeo Adblock Plus Chrome Extension

CVE-2026-7686

What is CVE-2026-7686?

A vulnerability exists in the Eyeo Adblock Plus Chrome extension, specifically within the postMessage function of the premium.preload.js file related to the Legacy Premium Activation component. This flaw allows for improper access control, potentially enabling remote exploitation. Although the exploit has been disclosed, it is important to note that the affected code flow has been deprecated and migrated to a new user account-based licensing system. The flaw does not grant permanent access to Premium features, as the licensing server issues a short-lived trial license, which ultimately expires unless validated against a legitimate subscription. While the exploit is theoretically possible, it carries minimal risk to users and the vendor per their assessment.

References