319 Chrome Add-Ons Hijack User Searches

Researchers linked 319 Chrome extensions to a long-running search-hijacking operation affecting roughly 13.4 million installs over time. The extensions were promoted as useful tools, such as PDF converters and safe-search helpers, but routed searches through operator-controlled servers to generate referral revenue and expose users’ queries.

Key findings

• The operation used 319 browser extensions and was linked to approximately 13.4 million installs across a decade; this does not mean all users remain affected today.
• Extensions posed as useful utilities, including PDF converters, manual finders, safe-search tools, and AI search helpers.
• Paid advertisements, popovers, and popunders directed users to landing pages that encouraged installation of the extensions.
• The extensions abused Chrome’s search-provider override setting to route search queries through operator-controlled infrastructure before reaching Yahoo or Bing.
• The intermediary infrastructure gave operators visibility into users’ searches and allowed them to alter destinations or redirect paths.
• Many extensions were unlisted in the Chrome Web Store, making them accessible by direct link but harder to find through ordinary store searches.

Who’s being targeted

• Commonly targeted roles: All employees, Chrome users, IT support, Endpoint management teams, Security awareness teams.
• Affected industries: Cross-industry, Organizations using Google Chrome.
• Attack channels: website.
• Impersonated: A seemingly legitimate browser-extension publisher.

Awareness takeaways

• Only install browser extensions from approved sources, and be especially cautious of utility extensions promoted through online advertisements.
• Treat any request to change the default search engine as a security and privacy decision, not a routine browser setting.
• Report unexpected search redirects and remove unfamiliar extensions instead of assuming a familiar Yahoo or Bing results page is safe.
• Use managed browser extension allowlists and include search-provider settings in routine endpoint checks.

Red flags to watch for

• The tool is reached through a paid ad, popover, or popunder rather than a trusted internal software catalog.
• The extension requests or announces a search-engine change for a feature that does not clearly require it.
• The extension is unlisted in the Chrome Web Store or is available only by direct link.