319 Chrome extensions with 13.4 million installs caught rerouting user searches

A search-hijacking campaign has been running through 319 Chrome extensions with a combined 13.4 million reported installs, BleepingComputer reported, citing research by Socket. The extensions quietly take over the browser's default search engine and funnel users' queries through proxy servers to collect advertising referral payments from Bing and Yahoo. Because many of the add-ons request no permissions and carry almost no code, they can be hard for users to recognize as risky.

What happened

According to BleepingComputer, Socket researcher John Tuckner identified the extensions and built on an April 2025 finding of 57 extensions with roughly six million users, adding 264 newly identified extensions and about 8.7 million more users. Tuckner described the operators this way: they "quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID."

The extensions pose as PDF converters, manual finders, safe-search tools and AI search tools. They are hosted on the Chrome Web Store but unlisted, so they don't surface in store searches; instead, they are promoted through ads on low-quality websites. The report says Chrome's built-in chrome_settings_overrides setting lets an extension replace the default search provider, so many of these add-ons need very little code — one example consisted of only a manifest and icons, with no background scripts, content scripts or requested permissions.

Why it matters

Searches pass through a chain of sites before reaching Bing or Yahoo, and BleepingComputer notes the destination can change without any extension update — which could lead users to phishing sites or malicious downloads. Tuckner tested the "Predator Search" extension with six identical searches that ended in four different places, writing: "The extension never changed; the proxy chose each destination as the search came in." The largest recent cluster, "Bing-Search" (37 extensions, 2.2 million users), was promoted through Bidbrain ads, while the "SecuryBrowse" cluster (58 extensions, 4.9 million users) pushed security-themed add-ons such as Fire Shield, Securify and WatchTower.

What to do

BleepingComputer reports that most of these extensions had already been removed from the Chrome Web Store by the time Socket's report was published, but that new ones keep appearing. The outlet said it contacted Google for comment but had not received a response by publication. Socket advises users to uninstall the extensions listed in its report, run a full antivirus scan, and avoid installing unnecessary tools or add-ons from unknown publishers. Users should also review which extension controls their default search engine in Chrome's settings and remove any they do not recognize, and be wary of "safe search" or "AI search" add-ons advertised on unfamiliar sites.