Chrome Extensions With 13.4 Million Installs Caught Hijacking Searches

A report published by Socket researcher John Tuckner details a search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations. According to the findings, these add-ons redirected user searches through tracking servers to generate advertising revenue from Bing and Yahoo.

Overview of the Campaign

• Scale: 319 unlisted Chrome extensions and 13.4 million reported users.
• Mechanism: Utilizing Chrome's built-in 'chrome_settings_overrides' setting to alter default search engines.
• Disguises: Pretending to be PDF converters, safe search utilities, manual finders, and AI search tools.

How the Hijacking Works

The report explains that organized operators used unlisted extensions hosted on the Chrome Web Store, promoting them through shady advertisements on external websites. Instead of performing their stated functions, queries were routed through proxy servers to collect partner referral payments from Yahoo or Bing.

Researchers highlighted examples like the "Bing-Search" cluster and the "SecuryBrowse" wave, which included security-themed add-ons like Fire Shield and Securify. The Predator Search extension was also noted for dynamically changing destination URLs on identical queries, posing potential risks for redirection to phishing pages or malicious downloads.

Verification and Practical Implications

• Most of the identified extensions were reportedly removed from the Chrome Web Store at the time of publication, though new variants continue to emerge.
• Users are advised to review installed extensions against Socket's published list, remove unauthorized add-ons, run an antivirus scan, and exercise caution when downloading browser utilities from unknown publishers.
• Verification of the original announcement can be conducted by reviewing Socket's published security advisory and checking official Google Workspace or Chrome security updates.