I've already seen the bomb go off with an extension.

A top rated chrome extension was inserting porn Ads in Youtube's companion renderer element. Google removed it after I tweeted about it though.