319 Chrome extensions with 13.4 million installs hijacked users' searches

Security researchers at Socket have found 319 Chrome extensions, with an estimated 13.4 million installs between them, that took over the browser's default search engine and sent every query through servers their operators control. If you installed a "PDF converter", "safe search" or "manual finder" add-on from an ad or a pop-up, your searches may have been logged, and some of these extensions date back to 2016.

What the extensions did

The trick needs almost no code. Chrome lets an extension declare itself the default search provider through a manifest setting, chrome_settings_overrides. One example Socket analysed had no permissions, no scripts and no interface: just a manifest that sets the default search provider. Once installed, your searches went to the operator's proxy first, which recorded the query and then forwarded you, mostly to Yahoo and sometimes to Bing, earning a referral payment on the way.

Because the proxy decides where each search goes, the extension never has to change. In Socket's words: "The extension never changed; the proxy chose each destination as the search came in." That may be why these are hard to catch in review: the code contains almost nothing to flag. How so many got past Google's checks hasn't been explained.

The oldest extensions Socket tracked date from 2016. They posed as PDF tools, manual finders, safe-search and AI search helpers, and security add-ons with names like Fire Shield and WatchTower.

Why it matters

According to Socket, the operators could see your complete search history, "often tied to a unique identifier". That means your searches can be linked to each other over time. Searches reveal a lot: health worries, money problems, where you live, what you are about to buy.

There is a second risk. Since the destination is chosen on the server, the same extension could start sending you to phishing pages or fake results at any moment. Malwarebytes notes that Socket "did not find evidence that the extensions had done so", but nothing in the setup prevents it.

Most of these extensions were unlisted in the Chrome Web Store, so they never showed up in a store search. People reached them through ads and pop-unders on low-quality sites. That is why the official store being the source is less reassuring than it sounds. Google hasn't said whether all 319 have been removed, and it had not commented when BleepingComputer published its report.

How to check your browser

1. Open chrome://extensions and remove anything you don't recognise, no longer use, or remember installing from an ad.
2. Go to Settings → Search engine and set the engine you want. If Chrome says an extension is controlling this setting, that extension owns your searches. Remove it.
3. Compare your extension IDs (shown on chrome://extensions with Developer mode on) with the IDs in Socket's report.

A clean search setting doesn't prove every extension is safe, as Malwarebytes points out. The safest habit is to keep extensions to a handful from publishers you know. Its huge extension library is one reason Google Chrome scores 4 for extensions in our ratings. Campaigns like this are the other side of that openness. If you want a browser with strong defaults that needs fewer add-ons, see our list of the most private browsers.