319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users

A network of 319 browser extensions has been linked to search hijacking affecting roughly 13.4 million users over a decade.

Marketed as PDF converters, manual finders, safe search tools, and AI search helpers, these extensions redirect queries through operator-controlled servers before sending users to Yahoo or Bing.

The business model turns ordinary searches into referral income while exposing queries to an intermediary. Similar behavior appeared in an earlier Chrome extension search hijacking investigation involving 23 add-ons, showing how basic browser settings can support large advertising operations.

Researchers from Socket.dev identified the extensions in an investigation published on October 29, 2026. Researcher John Tuckner reported 264 newly identified extensions affecting another 8.7 million users.

The headline figure combines findings across years; it does not establish that 13.4 million people remain actively affected today.

319 Chrome Extensions Found Hijacking Searches

The central technique abuses Chrome’s chrome_settings_overrides.search_provider setting, which lets an extension replace the default search engine.

One analyzed extension, Safe Game Search, contained only a manifest and three icons. It had no background worker, content scripts, toolbar interface, or requested permissions beyond its search configuration.

Chrome displays an installation prompt about changing search settings, but Socket said it does not clearly explain where queries ultimately travel.

This creates a detection gap: an extension can appear harmless during a permissions review while still placing an outside server between users and their search results.

Operators earn money through search syndication programs, which share advertising revenue with partners supplying traffic. Tracking parameters identify the partner receiving credit.

The additional proxy gives operators visibility into queries and control over each destination, rather than simply directing searches straight to a recognized search provider.

That differs from the broader capabilities documented in a fake GoogleTranslate Chrome extension case, where researchers found browser surveillance and remote interaction.

Here, the critical issue is narrower: search interception can happen without the invasive scripts or permissions usually associated with browser malware.

Predator Search illustrated the server-side control. Six identical queries produced four outcomes, including Yahoo results, alternative landing pages, an additional redirect chain, and an error page.

The extension itself never changed. Socket observed mostly referral-tagged search traffic, not confirmed phishing delivery, so malicious payload redirection remains a potential escalation rather than an established outcome.

The privacy risk extends beyond a changed homepage. Queries can reveal health concerns, financial problems, workplace projects, and personal interests.

Since the intermediary receives searches first, an otherwise familiar results page does not mean the request followed a direct or private route.

Hidden Distribution, Operator Links, and Defensive Checks

Most identified extensions were unlisted in the Chrome Web Store. Their pages remained accessible through direct links but did not appear in normal store searches.

Paid advertisements, including popovers and popunders, brought users to landing pages promoting apparently useful tools and encouraging installation.

The activity stretches back to 2016. Socket linked about 111 extensions and roughly 2.2 million installs to Intango LTD. Another cluster, SecuryBrowse, accounted for 58 extensions and approximately 4.9 million users.

A newer Bing-focused group contained 37 extensions, with coordinated updates across supposedly separate publishers providing evidence of shared operation.

Investigators combined store listings, privacy policies, Google Ads Transparency records, Censys, urlscan, and DecryptAds to connect landing pages and advertisers.

Shared advertising accounts and search partner tags helped reveal relationships that separate extension names and publisher branding could otherwise conceal.

Removal alone also has limits for investigators tracking the wider operation. Socket noted that domains can remain active after associated extensions disappear.

Following shared infrastructure and advertising relationships therefore provides a broader view than checking whether one individual store listing is still publicly available.

For defenders, the findings support checking search configuration alongside permissions. Earlier reporting on malicious Chrome extension infrastructure also highlighted the value of extension audits and managed allowlists.

Users should remove unfamiliar add-ons and verify their default search engine; organizations should investigate unexplained search redirects and restrict unapproved extensions.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post 319 Chrome Extensions Found Hijacking Searches, Affecting 13.4 Million Users appeared first on Cyber Security News.