319 Chrome Extensions Hijack User Searches

Researchers found 319 Chrome extensions, with 13.4 million reported installs, that quietly changed users’ default search settings and routed searches through operator-controlled servers. The extensions were promoted as useful tools through paid ads and installed through the normal Chrome Web Store process, while allowing operators to monitor searches, earn referral revenue, and potentially redirect users to harmful sites later.

Key findings

• Socket identified 319 Chrome extensions associated with 13.4 million reported installations.
• The extensions changed Chrome’s default search provider using the built-in chrome_settings_overrides feature.
• Operators routed search queries through servers they controlled, enabling search monitoring and advertising referral revenue.
• Many extensions were unlisted in the Chrome Web Store and were promoted through paid advertising campaigns, including Google Ads and Bidbrain.
• Because operators control the intermediary search servers, they could change destinations later and potentially send users to malicious websites without updating the extension.

Who’s being targeted

• Commonly targeted roles: All employees, Chrome users, IT support, Security awareness teams, Endpoint management teams.
• Affected industries: Consumers, All industries using Google Chrome.
• Attack channels: website.
• Impersonated: An advertised Chrome utility extension.

Awareness takeaways

• Do not install browser extensions solely because they appear in an advertisement; independently verify the publisher and extension identity first.
• Review installed browser extensions regularly, especially unfamiliar PDF, search, manual, and security-related tools.
• Treat an unexpected change to your browser’s default search engine or repeated redirects as a warning sign and report it to IT or security.
• Remove suspicious extensions promptly because their operators may later redirect searches to malicious destinations.

Red flags to watch for

• The extension is promoted through an advertisement rather than being found through a trusted internal software catalog.
• The extension is unlisted or cannot be found through normal Chrome Web Store searches.
• The extension changes the browser’s default search provider after installation.