Chrome extensions hijack searches for 13.4M users, Socket finds
Socket catalogued 319 Chrome extensions, ~13.4 million installs, that silently reroute searches through operator proxies to skim referral fees — and can redirect anywhere.
Supply-chain security firm Socket published a catalogue on 29 October of 319 Chrome extensions — roughly 13.4 million combined installs — that quietly hijack the browser's default search engine, routing queries through operator-controlled proxies before they reach Bing or Yahoo and skimming referral fees along the way. The report, Searchjacked by researcher John Tuckner, expands his earlier work; this round adds 264 extensions and about 8.7 million users to bring the tracked total to 319. Some of the extensions date back to 2016.
How it works
The extensions pose as PDF converters, "safe search" tools, manual finders, and AI search helpers. They take over the default engine using Chrome's built-in chrome_settings_overrides with a search_provider block and is_default: true — a declarative manifest field, not executable code. Some of the extensions are almost empty: one example ships only a manifest and icons, with no permissions, content scripts, or background worker. Searches then pass through operator proxy servers before hitting the real engine. Monetization rides on syndication partner IDs — Yahoo's hspart=/hsimp= and Bing's PC=/PTAG= parameters.
Scale and clusters
Socket breaks the 319 into operator clusters, including:
- SecuryBrowse (2024 wave): 58 extensions, ~4.9M users — brands "Fire Shield," "Securify," "WatchTower," "Wise Ghost," "Protecto."
- Bing-Search (2025–2026): 37 extensions, ~2.21M users.
- Intango LTD: 111 extensions, ~2.19M users.
- A single "Free Planet VPN" extension at ~2M users.
Most of the hijacking extensions are unlisted in the Chrome Web Store, so they don't appear in store search, and they're pushed through paid ads (Google Ads, Bidbrain) as pop-overs and pop-unders on low-quality sites.
The real risk
The referral skimming is the benign end. The operator sees every full search query, often tied to a unique identifier, and chooses the destination per request. In Tuckner's test of one extension, Predator Search, six identical queries landed in four different destinations — "the extension never changed; the proxy chose each destination as the search came in." That indirection means today's ad redirect can become tomorrow's phishing page or malware lure with no extension update and no new Web Store review.
Action checklist
- Inventory installed Chrome extensions across managed fleets and flag anything that sets a custom default search engine, cross-referencing Socket's published list.
- Remove extensions that override search without a clear reason, and run an AV scan on affected machines.
- Enforce an extension allowlist via Chrome Enterprise policy (
ExtensionInstallAllowlist/ExtensionSettings) — unlisted, ad-distributed extensions can't be caught by store search alone. - Teach users that "safe search" and "PDF converter" add-ons are a standard lure for this class of hijacker.
Context
Browser-extension search hijacking is a recurring problem: Socket flagged a separate network of 152 wallpaper extensions (~105,000 installs) earlier in 2026. What's new here is the scale — 13.4 million installs — and the proxy indirection that leaves the final destination mutable long after a user installs and the store reviews the code.