Is Ad Skip Master for Youtube safe?

Medium risk

Ad Skip Master for Youtube is medium risk. The extension advertises only YouTube ad-skipping, but host permissions cover every https:// site. On every completed page load anywhere, it sends the current and previous page URL to adskipmaster.com, tagged with its Google Analytics ID.

mauricebuckner966v1.2.1Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Ad Skip Master reports every site you visit, not just YouTube

The extension advertises only YouTube ad-skipping, but host permissions cover every https:// site.

On every completed page load anywhere, it sends the current and previous page URL to adskipmaster.com, tagged with its Google Analytics ID.

Severity
Medium unwanted
Type
Unexpected
CWE
CWE-359
Source
Dynamic sandbox
What actually happens
You did this

You finish loading any https:// page, not just youtube.com.

The extension's only advertised feature is a YouTube ad-skip toggle, but host_permissions cover every site.

The extension did this

The extension sends that page's URL and your previous page's URL to its own server.

The request is tagged with the same persistent ID it already generates for Google Analytics.

What each navigation request contains
  • Page you just loaded
    https://en.wikipedia.org/wiki/Web_browser

    The full address of the page you finished loading, on any site.

  • Page you loaded before that
    https://example.com/

    The previous page in the same tab, letting the server reconstruct your click path.

  • Persistent tracking ID
    b5b4f396-397c-4cab-872e-9d1cbcee5986

    The same ID the extension already generates for its own Google Analytics traffic, sent here as the request's API key.

Captured request
POSThttps://adskipmaster.com/api/regex_list?_nocache=1757296972453
Headers
X-API-KEY
b5b4f396-397c-4cab-872e-9d1cbcee5986
Content-Type
application/json
Body
[  "https://en.wikipedia.org/wiki/Web_browser",  "https://example.com/"]
The code that does this

The navigation listener fires on every tab, not just YouTube

Readable version

GA client ID passed in as the ad-server API key

js/background.js
const Tb = new uA.Analytics("G-E1W95MTY1K", "<redacted>"),  wB = await Tb.getOrCreateClientId();Tb.fireEvent("run"), chrome.alarms.create(Tb.measurement_id, {  periodInMinutes: 60}), chrome.alarms.onAlarm.addListener(() => {  Tb.fireEvent("run")});const XH = new zC.default(ZA, wB);XH.init()

fetchRegexList and onUpdatedHandler

js/background.js
async fetchRegexList(rx, ZA) {  try {    const Tb = await fetch(`https://adskipmaster.com/api/regex_list?_nocache=${Date.now()}`, {      method: "POST",      headers: {        "Content-Type": "application/json",        "X-API-KEY": this.api_token      },      body: JSON.stringify([rx, ZA])    });    if (Tb.ok) {      const rx = await Tb.json();      if (Array.isArray(rx) && rx.length) this.REGEX_LIST = rx, this.adRegex = new RegExp(rx.join("|"))    }  } catch (rx) {}}async onUpdatedHandler(rx, ZA, Tb) {  if (Tb.url && Tb.id) {    if (ZA.status === "complete") {      const rx = this._context.get(Tb.id);      this._context.set(Tb.id, Tb.url), this.fetchRegexList(Tb.url, rx)    }    if (this.youtubeRegex.test(Tb.url)) this.watchedTabs.add(Tb.id);    else this.watchedTabs.delete(Tb.id)  }}
Where navigation data ends up
    • adskipmaster.com

    Receives the current and previous page URL from every completed navigation on every https:// site, tagged with the extension's persistent client ID.

    • www.google-analytics.com

    Receives the same persistent client ID through the extension's own Google Analytics (GA4) telemetry, confirming the ID is not request-specific.

Updated 30 September 2026imlalpfjijneacdcjgjmphcpmlhkhkho