Science & Tech · Cybersecurity · 6 hrs ago
319 Chrome extensions linked to search hijacking and 13.4 million installs
Researchers identified 319 Chrome extensions that reroute users’ searches through servers controlled by the extensions’ operators.
The add-ons reportedly had 13.4 million installs combined and often pose as PDF tools, search helpers or other useful utilities.
They change Chrome’s default search setting, then pass searches on to Bing or Yahoo to generate referral payments.
Because every search passes through an operator’s server, the operators can see users’ search activity, which may be linked to an identifier.
Researchers warn the redirects could change to send people to phishing sites or malicious downloads, but they did not say those harmful redirects were already happening.
Many of the extensions were removed from the Chrome Web Store, but researchers said new ones kept appearing.
Users are advised to remove extensions they do not recognize, check their default search engine and avoid add-ons from unknown publishers.
A Socket investigation identified 319 Chrome extensions linked to search hijacking, with a combined 13.4 million reported installations.
The extensions change users’ default search engine and route searches through servers controlled by their operators before sending them to Bing or Yahoo.
The operators can earn referral payments, while the routing also lets them see users’ searches and potentially change where searches lead.
The extensions are promoted as tools such as PDF converters, safe-search helpers and AI search add-ons, often through advertisements on websites.
Socket researcher John Tuckner warned that the setup could redirect users to phishing sites or malicious downloads, though the sources do not report that this is currently happening.
- Who
- The extensions’ operators and users. Socket researcher John Tuckner reported the findings.
- What
- 319 Chrome extensions were linked to search hijacking and 13.4 million reported installations. They route searches through operator-controlled servers.
- When
- The report was published on October 29, 2026. The research expands on a discovery reported in April 2025.
- Where
- The extensions target Chrome users and are promoted through advertisements on websites. Some are hosted on the Chrome Web Store but are unlisted.
- Why
- The extensions route searches to generate referral payments from Bing or Yahoo. The routing also creates a potential risk of redirects to phishing or malicious downloads.
This story does not have two clearly opposing sides.
Tuckner reported finding 57 Chrome extensions with 6 million users.
BleepingComputer published Socket’s expanded findings, identifying 264 additional extensions and reporting 319 in total.
Most of the extensions had been removed from the Chrome Web Store, but new ones were continuing to appear.
- Extensions identified
- 319
- Combined reported installations
- 13.4 million
- Earlier findings
- 57 extensions and 6 million users in April 2025
- Largest recently active cluster
- Bing-Search”: 37 extensions and 2.2 million users
- Another extension wave
- SecuryBrowse”: 58 extensions and 4.9 million users
3 sources
What people are saying
These extensions were created by a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID
The search referral revenue is a profitable watering hole while the proxy operator can wait for data to accumulate and targets to surface before redirecting to malicious search results or landing pages for phishing or other malicious downloads