319 Chrome extensions hijacked searches, impacting 13.4 million users

A network of 319 browser extensions has been linked to search hijacking that affected an estimated 13.4 million users over about a decade.

Presented as PDF converters, manual finders, safe-search utilities, and AI search assistants, these extensions intercept queries and route them through servers controlled by their operators before finally sending users to Yahoo or Bing.

The operators monetize this by turning ordinary searches into referral traffic, exposing user queries to an intermediary in the process. Similar tactics surfaced in an earlier investigation into Chrome extension search hijacking involving 23 add-ons, illustrating how basic browser settings can be abused to run large advertising operations.

Researchers at Socket.dev published the investigation on October 29, 2026. Researcher John Tuckner reported 264 newly identified extensions that added roughly 8.7 million affected installs to the earlier findings.

The 13.4 million figure aggregates discoveries made across multiple years; it does not mean 13.4 million people remain actively affected right now.

319 Chrome extensions found hijacking searches

The core technique abuses Chrome’s chrome_settings_overrides.search_provider setting, which allows an extension to replace the browser’s default search engine.

One example, Safe Game Search, consisted only of a manifest and three icons. It had no background worker, content scripts, toolbar UI, or permissions beyond its search configuration.

Chrome shows an installation prompt about changing search settings, but Socket.dev says that prompt does not clearly explain where queries are ultimately routed.

That creates a detection gap: an extension may look innocuous during a permissions review yet still place an outside server between the user and their search results.

Operators earn revenue through search syndication programs that share advertising income with partners that supply traffic. Tracking parameters embedded in redirected requests identify the partner receiving credit.

The extra proxy gives operators visibility into users’ queries and lets them control each landing page, rather than simply forwarding searches directly to a well-known search provider.

This behavior is narrower than the full browser surveillance and remote-interaction capabilities seen in other cases (for example, a fake Google Translate extension). The salient risk here is that search interception can occur without the invasive scripts or permissions commonly associated with browser malware.

Socket.dev’s analysis of “Predator Search” showed server-side control in action: the same query run six times produced four different outcomes, including Yahoo search results, alternate landing pages, an extra redirect chain, and an error page.

The extension itself did not change during those tests. Socket observed mostly referral-tagged search traffic rather than confirmed phishing payloads, so redirecting users to malicious content remains a potential escalation rather than a documented outcome in this dataset.

The privacy risk goes beyond a changed homepage: search queries can reveal health concerns, financial issues, work projects and personal interests. Because an intermediary receives the query first, a familiar-looking results page does not guarantee the request travelled directly or privately.

Hidden distribution, operator links, and defensive checks

Most of the extensions identified were unlisted in the Chrome Web Store; their pages were reachable via direct links but did not appear in normal store searches.

Paid advertisements, including popovers and popunders, drove users to landing pages promoting seemingly useful tools and urging installation.

The activity stretches back to 2016. Socket.dev attributed roughly 111 extensions and about 2.2 million installs to Intango LTD. Another cluster operating under the SecuryBrowse name involved 58 extensions and approximately 4.9 million users.

A newer, Bing-focused cluster contained 37 extensions; coordinated updates across supposedly separate publishers provided evidence of shared operation.

Investigators linked store listings, privacy policies, Google Ads Transparency records, Censys, urlscan and DecryptAds to connect landing pages and advertisers.

Shared advertising accounts and partner tags helped reveal relationships that separate extension names and publisher branding would otherwise hide.

Removal of extensions from the store is not the whole story: Socket.dev noted domains can stay active after their associated extensions disappear. Tracking shared infrastructure and advertising relationships gives a broader view of the operation than checking whether a single store listing remains publicly available.

For defenders, the findings support auditing search configuration in addition to extension permissions. Prior reporting on malicious Chrome extension infrastructure also emphasized the value of extension audits and managed allowlists.

Users should remove unfamiliar add-ons and confirm their default search engine. Organizations should investigate unexplained search redirects and block unapproved extensions.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.