319 Malicious Chrome Extensions Expose 13.4 Million Users to Search Hijacking

The findings come from a report published on October 29, 2026, by cybersecurity researcher John Tuckner of Socket. The investigation expands on research first published in April 2025, when 57 extensions with approximately six million installations were identified. The latest investigation uncovered another 264 extensions, accounting for an additional 8.7 million installations.

Together, the two investigations identified 319 distinct extensions associated with approximately 13.4 million installations over a period spanning nearly a decade. This is a cumulative figure rather than a count of users currently exposed at the same time. The extensions date back to at least 2016, indicating that the technique has been used repeatedly by different operators rather than emerging as a single isolated incident. .

How Malicious Chrome Extensions Hijack Search Results

The technique, commonly described as search hijacking or searchjacking, involves changing the browser’s default search provider without providing users with a clear understanding of how their searches will be processed.

Instead of sending a query directly to the selected search engine, the extension routes it through a proxy server controlled by its operators. The request is then forwarded to services such as Bing or Yahoo, sometimes through several intermediate websites.

This arrangement allows operators to monitor the searches passing through their infrastructure and associate queries with identifiers that can help recognize activity over time. Search terms can reveal information about personal interests, financial concerns, health-related questions and professional activities, making this type of data particularly sensitive.

The operators also exploit referral agreements with search providers. By inserting partner identification codes into redirected searches, they can generate advertising-related payments when traffic reaches Bing or Yahoo.

According to Socket, the extensions can achieve this through Chrome’s built-in settings override functionality. This mechanism allows an extension to modify certain browser settings, including the default search provider, using configuration information in its manifest file.

Some of the extensions examined contained very little code. In one example, the researcher found an extension consisting essentially of a manifest and icon files, without background scripts or content scripts. This demonstrates how a seemingly simple browser add-on can influence the destination of users’ searches without requiring an elaborate software package.

Fake PDF Converters and Security Tools Help Spread the Extensions

Another important aspect of the investigation concerns the distribution strategy. Rather than relying exclusively on searches within the official Chrome Web Store, operators promoted their extensions through advertisements on external websites.

The advertised products appeared to offer useful services, including PDF conversion, document and instruction manual searches, safer browsing and artificial intelligence-powered search tools.

Users encountering these advertisements were directed to landing pages where they could install the corresponding extensions. Although many were available through Google’s official Chrome Web Store, they were configured as unlisted extensions, meaning they did not normally appear in the store’s internal search results.

Unlisted status does not mean that an extension is invisible or inaccessible. Its listing can still be opened through a direct link, which is precisely how users can be directed to it through external advertisements.

The investigation also identified groups of extensions associated with identifiable operators. One cluster, known as SecuryBrowse, included 58 extensions with approximately 4.9 million installations. Another group, identified as Bing-Search, contained 37 extensions with approximately 2.2 million installations.

Socket attributed approximately 200 extensions, accounting for 5.68 million installations, to identifiable operators. The remaining 119 extensions, representing approximately 7.8 million installations, could not be confidently attributed to known operators.

The Risk Goes Beyond Advertising Fraud

Although the principal activity documented in the investigation involved search redirection and referral monetization, researchers warn that the infrastructure could potentially be used for more harmful purposes.

Because operators control the proxy servers receiving search requests, they can change the destination of individual searches without necessarily modifying or updating the installed extension.

This creates an opportunity to redirect selected users towards fraudulent websites, phishing pages or malicious downloads. For example, someone searching for a banking service, software update or technical support could potentially be directed to a deceptive website designed to collect sensitive information.

However, an important distinction must be made: Socket did not establish that the investigated extensions had already carried out such phishing or malware distribution campaigns. The researcher identified this as a potential future abuse of the infrastructure rather than a confirmed activity in the investigation.

The immediate documented concerns are the interception of search queries, control over search destinations and unauthorized monetization of redirected traffic.

How to Check Whether Your Chrome Browser Is Affected

Google Chrome allows users to review, disable and remove installed extensions. Security specialists recommend checking the browser regularly, particularly if an unfamiliar add-on was installed after clicking an advertisement or searching for a specific utility.

Users can take several practical steps to reduce their exposure:

1. Review installed extensions. Enter chrome://extensions in the browser’s address bar. Examine the installed add-ons and remove anything unfamiliar, unnecessary or untrusted. Compare suspicious extensions against the list published in Socket’s investigation.

2. Check the default search engine. Open Chrome Settings and review the search engine configuration. If an unfamiliar extension controls this setting, investigate it and remove it if it is not trusted.

3. Review extension permissions. Check whether an add-on can read or modify information on websites you visit. Google allows users to restrict site access to specific websites or require permission each time an extension is used.

4. Remove suspicious software. If the browser continues redirecting searches or displaying unwanted pages after an extension has been removed, Google recommends checking the computer for potentially unwanted software and running appropriate antivirus or antimalware scans.

5. Download extensions cautiously. Install only tools from developers whose identity and reputation can be verified. Avoid unnecessary extensions promoted through unexpected advertisements or websites offering services that do not require a permanent browser add-on.

Google provides additional instructions through its .

Why Browser Extension Security Matters for Businesses

The investigation also highlights a cybersecurity issue for companies that rely on browser-based applications, cloud services and online communication platforms.

Employees frequently install extensions to improve productivity, convert documents, manage passwords, translate content or automate everyday tasks. However, every additional component introduces another potential point of exposure, particularly when organizations do not monitor which extensions are being used.

In corporate environments, compromised or untrusted extensions can expose sensitive search activity and create opportunities for employees to encounter fraudulent websites or malicious downloads.

Businesses can reduce these risks by maintaining approved extension lists, limiting installation privileges where appropriate and reviewing the software used on company devices. Google’s Chrome Enterprise management capabilities also allow organizations to establish policies governing which extensions employees can install.

For individuals and companies alike, the investigation demonstrates that downloading an extension from an official browser store does not automatically guarantee that it is safe. Regular reviews, careful assessment of developers and limited permissions remain important elements of online security.

With 319 extensions identified across multiple campaigns, the Socket investigation illustrates how seemingly harmless browser utilities can become tools for collecting information and manipulating internet traffic. The challenge for users is not simply avoiding obviously suspicious software, but recognizing that even familiar productivity tools can introduce privacy and security risks.