319 Chrome extensions with 13.4 million installs quietly hijacked users' searches, researchers say
Posing as PDF, safe search and AI tools, they route every search through operators' servers for Bing and Yahoo referral fees. Here's how to check.
The skim
- Researchers at Socket found 319 Chrome extensions, with about 13.4 million installs between them, that take over your default search engine and send every query through servers their operators control.
- They pose as PDF converters, manual finders, "safe search" and AI search tools. Most are unlisted in the Chrome Web Store and get installed through ads on other websites.
- For now the operators mostly profit from Bing and Yahoo referral fees. But the proxy decides where each search lands, so it could send users to phishing pages at any time.
What the researchers found
Socket researcher John Tuckner published the report late Wednesday, building on his April 2025 discovery of 57 extensions with 6 million users. The new research adds 264 extensions and another 8.7 million users. The oldest date back to 2016. Taken together, Socket says, the group would rank among the top 25 Chrome extensions by popularity.
Many of them barely contain any code. Chrome lets an extension replace the default search provider with one setting in its manifest file. Socket shows one extension, "Safe Game Search," that is nothing but that file and three icons, with no permissions requested. Socket warns that this is why they can look harmless to anyone who only checks for risky permissions.
Once installed, your searches go to the operator's server first, then on to Yahoo or Bing tagged with a partner ID that earns the operator a share of the ad revenue. The operator sees your full search history along the way. Socket found a handful of organized operators behind the batch. One company, Intango, has published about 111 extensions with roughly 2.2 million installs since 2018, each with its own domain so it looks like an independent developer.
Why it matters
The bigger risk is what the proxy could do next. Socket ran six identical searches through one extension, Predator Search, which has 50,000 users. They ended up in four different places: straight to Yahoo, a landing page on another site, a detour through two other domains before Yahoo, and an error page. "The extension never changed; the proxy chose each destination as the search came in," Tuckner wrote. That means an operator can quietly start serving fake results or malware lures to particular searches or countries without ever updating the extension.
It also shows a gap in Chrome Web Store policing. Socket argues that an extension whose only job is to capture searches, that hides from store search and is promoted through cheap ads, "should be considered malicious by definition." Most of the listed extensions had already been removed from the store when the report went out, according to BleepingComputer, but new ones keep appearing. Google hadn't commented to BleepingComputer by publication.
What to do
Open chrome://extensions and remove anything you don't remember installing, especially search, PDF or "safety" add-ons. Then check Settings > Search engine to make sure your default is the one you picked. Socket's report lists every extension ID if you want to check by name. Chrome has been tightening other defaults lately, like warning before insecure HTTP sites, but extensions still get a lot of trust.
Sources: Socket and BleepingComputer.
