HOW I FOUND A BYPASS IN GOOGLE'S BIG ANTI-ADBLOCK UPDATE

Summary from the TLDR InfoSec newsletter

The author discovered a Chrome bug that allowed MV3 extensions to bypass Google's removal of webRequestBlocking (which kills adblockers) by exploiting legacy JavaScript bindings and creating fake webRequest events with spoofed WebView IDs. The exploit worked by using the constructor of existing webRequest events to create new events with the opt_webViewInstanceId parameter set, which skipped permission checks for webRequestBlocking since the browser never verified if the extension had WebView permissions. Google patched the vulnerability in Chrome 118 by adding proper permission validation, although it didn't award a bounty since it didn't expose new data to extensions.