16.07.2026
3 min
441
Researchers discovered hundreds of Google Chrome extensions that silently changed users’ default search engines and redirected their queries through third-party servers. Together, these extensions accumulated more than 13 million installations, allowing their operators to profit from search traffic while potentially collecting users’ search histories.
On October 29, 2026, cybersecurity researchers at Socket published a study titled Searchjacked, exposing a large network of 319 Google Chrome extensions. Over the past decade, these extensions accumulated approximately 13.4 million installations. Most were unlisted in Chrome Web Store search results and were distributed through advertisements for PDF converters, secure search tools, and other seemingly useful services.
The researchers discovered that several organized operators were behind the extensions, using similar monetization schemes. Once installed, an extension changed the browser’s default search engine, routing all user queries through a proxy server controlled by its operator. Only then were users redirected to Bing, Yahoo, or another search engine with affiliate tracking identifiers that generated advertising revenue for the extension owners.
“They silently hijack the browser’s default search engine, route every query through a suspicious proxy server, and collect affiliate payouts from Yahoo or Bing using the corresponding identifier,” Socket researchers explained.
Interestingly, many of the discovered extensions did not even require malicious JavaScript or special permissions. Some consisted of little more than a manifest.json configuration file and a few icons. They had no user interface, background processes, or features that could provide any real benefit to users. Their primary purpose was to change the default search engine using Chrome’s built-in functionality.
During installation, the browser warned users that their search engine would be changed but did not explain where their queries would actually be sent. As a result, users could continue receiving normal Bing or Yahoo search results without realizing that every search first passed through a third-party server.
This mechanism allowed operators not only to profit from search engine affiliate programs but also to access users’ complete search histories, potentially linked to unique user identifiers. Researchers suggested that the collected data could also be used to analyze search trends, audience sentiment, and the geographic distribution of user interests. However, no evidence was presented that this information had been sold to third parties.
Another important detail was that proxy server operators could independently determine the final destination of each search query. During testing, Socket found cases where repeated searches were redirected to Google’s homepage without affiliate identifiers, while others were sent to Bing. For example, six identical queries made through the Predator Search extension produced four different outcomes, including Yahoo, intermediary search websites, and a Cloudflare error page. The extension itself remained unchanged, while the server controlled the routing.
“This means that redirects are selected individually for each request based on the search query itself,” Socket researchers noted.
The researchers warned that this approach could potentially be used to redirect users to phishing pages, manipulated search results, or websites hosting malicious downloads. Operators could also select targets based on search terms or geographic location. However, Socket did not observe any confirmed malicious redirects during its investigation, meaning this remains a potential risk rather than a demonstrated attack.
The extensions were promoted through advertising networks, including Google Ads and Bidbrain. Users were shown pop-up advertisements offering to find device manuals, convert PDF files, use secure search services, or install AI-powered tools. Clicking an advertisement opened a landing page with a button directing users to install the extension through the Chrome Web Store.
Most of the identified extensions were unlisted, meaning they did not appear in Chrome Web Store search results but remained accessible through direct links. This approach allowed operators to keep their products out of the spotlight while still using the Chrome Web Store to distribute them. According to the researchers, users needed only a few clicks to install an extension and could quickly forget it was even there.
Socket was able to link 200 extensions to specific operators. Together, these extensions accounted for approximately 5.7 million installations. Another 119 extensions, with around 7.8 million installations, were linked to unidentified operators.
One of the largest groups identified was SecuryBrowse, which included 58 extensions with approximately 4.9 million installations. They disguised themselves as security tools under names such as Fire Shield, Wise Ghost, Securify, Protecto, and WatchTower. Some of these extensions requested additional sensitive permissions beyond changing the default search engine.
Another group, Bing-Search, consisted of 37 extensions with approximately 2.2 million installations. They were distributed through Bidbrain advertisements, while shared Bing affiliate identifiers and synchronized updates pointed to a single operator. In June 2026, for example, fifteen seemingly independent publishers updated their extensions within just four days.
Among the identified operators, researchers also named advertising company Intango LTD, which had released approximately 111 extensions since 2018, accumulating around 2.2 million installations. About 279 domains were used to distribute these extensions, with each add-on having its own website and contact email address to create the appearance of an independent developer. Most of these extensions redirected searches to Yahoo, while another 15 used Bing.
According to Socket, Tightrope Interactive ran approximately 200,000 advertisements across 307 domains. Researchers also identified Free Planet VPN S.R.L., which operated an extension with 2 million users, and Kinner Lake Ltd, which had six extensions with 300,000 users, along with several other advertising and technology companies. However, not all operators left enough information to identify their owners.
The scheme has been operating since at least 2016. Among the earliest examples, researchers cited the Yandex Search extension, with 200,000 users, and HermesTab, whose two extensions accumulated approximately 400,000 installations combined. A major wave of SecuryBrowse extensions emerged in 2024, while extensions focused on redirecting searches to Bing became more widespread throughout 2025 and 2026.
Socket noted that even after individual extensions are removed from the Chrome Web Store, operators quickly create new domains and advertising landing pages, meaning the problem does not disappear when a single extension is blocked. In its research, the company also referenced earlier analysis by Secure Annex, while the complete list of identified extensions, including their IDs and publication dates, is available in Socket’s report.
At the time of publication, Google had not yet commented on the research findings. Security experts emphasized that the absence of additional permission requests does not necessarily make an extension safe, as even a simple change to the default search engine can expose a significant portion of a user’s online activity to a third-party operator.
Chrome users are advised to review their installed extensions by visiting chrome://extensions, remove unfamiliar or unnecessary add-ons, and make sure their preferred search engine is selected in the browser settings. Particular attention should be paid to extensions installed through advertisements promising PDF conversion, secure search, or other simple features.
