Chrome extensions with 13.4 million installs caught hijacking searches

A report from Socket describes 319 Chrome extensions with a combined 13.4 million reported installations that redirected users’ searches through tracking servers to generate advertising revenue from Bing and Yahoo.

Researcher John Tuckner’s report expands on his April 2025 discovery of 57 extensions with 6 million users. It adds 264 newly identified extensions with another 8.7 million users. The add-ons posed as PDF converters, manual finders, safe-search tools and AI search tools. Socket says many were unlisted on the Chrome Web Store, despite being hosted there.

The extensions used Chrome’s built-in “chrome_settings_overrides” setting to replace the default search provider. Socket says one example had only a manifest and icons, with no background scripts, content scripts or requested permissions.

The extensions routed searches through operator-controlled servers before sending them to Bing or Yahoo. Tuckner warned that operators could change the destination without updating an extension, potentially redirecting users to phishing sites or malicious downloads.

One recently active cluster, “Bing-Search,” included 37 extensions with 2.2 million users. Another, “SecuryBrowse,” included 58 extensions with 4.9 million users. Tuckner said most extensions in the report had been removed from the store when it was published, but new ones continued to appear. BleepingComputer said it contacted Google for comment and had not received a response by publication.