Socket researcher finds 319 Chrome extensions hijacking searches

Researcher John Tuckner at Socket said on Oct. 29, 2026 that 319 Chrome extensions posing as PDF and search tools collected roughly 13.4 million installations over 10 years and seized control of users’ default search settings.

The extensions abused Chrome’s chrome_settings_overrides.search_provider setting, a browser feature that lets an add-on replace the default search engine. Queries passed through operators’ proxy servers, intermediary machines that forward requests, which tracked queries before redirecting users to Bing, Yahoo, or other destinations. The proxy could pick a different destination for each search, producing varied results such as Yahoo pages, landing pages, redirect chains, and errors. Socket researcher John Tuckner said, “The extension never changed; the proxy chose each destination as the search came in.

Operators could view users’ search queries and collect referral payments from Yahoo or Bing search syndication programs. Queries were often tied to a unique identifier that could let operators link a user’s searches over time. Search syndication programs share advertising revenue with traffic partners, and tracking parameters identify which partner receives credit.

The 13.4 million figure is a cumulative count of reported installs, not a count of users actively affected today, and one person could have installed more than one extension, so the install count does not equal the number of distinct users. Socket’s Oct. 29, 2026 report added 264 newly identified extensions affecting about 8.7 million users beyond earlier findings. Socket’s earlier April 2025 research found 57 extensions with 6 million users, and two large extension families represent roughly 7.1 million users out of 13.4 million reported installs. Socket’s research focuses on the Google Chrome desktop browser and extensions from the Chrome Web Store.

Socket said 200 extensions reaching about 5.7 million users belong to identifiable operators, while 119 extensions with 7.8 million users belong to unknown operators. Socket connected roughly 111 extensions and about 2.2 million installations to Intango LTD. The SecuryBrowse cluster accounted for 58 extensions and approximately 4.9 million users. Bing-Search comprised 37 extensions distributed through Bidbrain ads and reached 2.2 million users.

Some extensions contained only a manifest file and icons, with no background scripts, content scripts, interface, or extra permissions. The extension Safe Game Search consisted of only a manifest and three icons, with no background worker, content scripts, a toolbar interface, or extra permissions. Most extensions were unlisted in the Chrome Web Store, reachable by direct link but hidden from ordinary store searches. Ads on networks including Google Ads promoted the extensions as manual finders, PDF converters, safe search, and AI search tools, and the campaign used paid popover and popunder ads to send users to landing pages that promoted useful tools and encouraged installation.

The extensions disguised themselves as PDF converters, manual finders, safe search tools, and AI search helpers. The SecuryBrowse wave promoted security-themed add-ons including Fire Shield, Securify, and WatchTower. Six identical searches through the Predator Search extension reached four different destinations although the extension itself never changed.

The main privacy risk was operator access to search queries, which can reveal health worries, financial problems, workplace interests, or other personal matters. No confirmed password or financial data theft; the confirmed harm is covert search redirection for ad revenue. Researchers did not observe malicious redirects or confirmed phishing delivery, and researchers warned that operators could send users to phishing pages or malware bait based on what they search or their location. Tuckner warned that search destinations can change at any time without an extension update, including redirects to phishing sites or malicious downloads.

Chrome shows a prompt when an extension changes the default search provider, though it does not say where searches will go. Seeing a normal results page does not prove a search took a direct or private path, since the intermediary gets the queries first. A missing notice that an extension controls a search setting does not prove every extension is safe.

By the time the report came out, most identified extensions had disappeared from the Chrome Web Store, but new ones are constantly added. BleepingComputer contacted Google for comment and had received no response by publication on Oct. 29, 2026, and Cybernews contacted Google for comment and said it would update the story with the response. Online Tech Tips found no official Google statement on blog.google or another verifiable Google channel as of Oct. 30, 2026; Google’s removal numbers and enforcement timeline remain unconfirmed, and Google has not said what, if anything, it did about already installed copies. Removing an extension from the store does not necessarily disable or remove a copy already installed in a browser, and no independent count confirms how many flagged extensions remain listed in the Chrome Web Store.

Malwarebytes says users should review extensions at chrome://extensions and remove unrecognized, unused, or untrusted extensions, including any on Socket’s affected list. Users should check Chrome search settings under Settings > Search engine and review or remove any extension shown as controlling the setting. Users should run a Malwarebytes or full antivirus scan to check for malicious extensions and other malware. BleepingComputer says users should refrain from downloading unneeded tools and browser extensions from publishers they do not know, and Socket advised organizations to investigate unexplained search redirects and block unapproved extensions.

Similar search hijacking behavior appeared in an earlier investigation involving 23 Chrome add-ons. BleepingComputer says browser-hijacking extensions have long blurred the boundary between potentially unwanted programs and malware, and it has covered hundreds of similar extensions. Investigators connected landing pages and advertisers using store listings, privacy policies, Google Ads Transparency records, Censys, urlscan, and DecryptAds. Shared advertising accounts and search partner tags revealed relationships hidden by separate extension names and publisher branding, and Socket noted that domains can stay active after their extensions disappear, so following shared infrastructure gives a broader view than checking individual store listings.