A security researcher has tied 319 Chrome extensions, with a combined 13.4 million reported installs, to a campaign that quietly takes over the browser's default search engine and routes every query through servers run by the extensions' operators. BleepingComputer and Digital Trends both reported the findings on 29 October.
The research comes from John Tuckner at the security company Socket. Xarmo hasn't checked Socket's report directly, so the details below are as BleepingComputer and Digital Trends report them.
What the extensions do
According to BleepingComputer, the extensions pose as PDF converters, manual finders, "safe search" tools and AI search helpers. Behind that, most of them do one thing: pass your searches through a chain of sites until they land on Bing or Yahoo.
BleepingComputer quotes Tuckner describing the extensions as the work of "a handful of organized operators all working from the same idea: quietly take over the browser's default search engine, route every query through a suspicious proxy server, and collect partner referral payments from Yahoo or Bing under a syndication partner ID."
The trick needs very little code. BleepingComputer says many of the extensions rely on Chrome's built-in chrome_settings_overrides setting, which lets an add-on replace the default search provider along with the homepage and startup pages. One example in the report, it says, contained only a manifest and icons: no background scripts, no content scripts and no requested permissions.
How people end up with them
BleepingComputer reports that the extensions were hosted on the Chrome Web Store but unlisted, so they didn't appear when people searched the store. Instead they were pushed through shady advertisements on other websites. Digital Trends puts it slightly differently, saying most were distributed outside the store, but agrees on the route in: spammy pop-up ads on smaller websites.
The scale has grown. BleepingComputer says the new report expands on Tuckner's April 2025 discovery of 57 extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million users. It names two of the largest recent clusters: "Bing-Search", with 37 extensions and 2.2 million users, often promoted through Bidbrain ads, and the "SecuryBrowse" wave, with 58 extensions and 4.9 million users, which pushed security-themed add-ons such as Fire Shield, Securify and WatchTower.
Why it matters beyond ad money
Right now the campaign mostly earns search referral revenue. Tuckner's warning, as BleepingComputer reports it, is that the operator's server picks the final destination, and that can change at any time without the extension itself being updated. That could mean phishing pages or malicious downloads instead of Yahoo. Digital Trends notes that Tuckner presents this as a potential risk, not evidence that such redirects are already happening. It also points out that because every search passes through the operator's server first, the people behind the extensions can see users' search history, often linked to a unique identifier.
BleepingComputer quotes his test of one extension, Predator Search: six identical searches sent through its proxy "ended in four different places", from Yahoo with partner tags to a Cloudflare error page. "The extension never changed; the proxy chose each destination as the search came in," Tuckner wrote.
What to do now
According to BleepingComputer, Tuckner said most of the extensions had been removed from the Chrome Web Store by the time the report was published, but new ones keep appearing. BleepingComputer's advice is to uninstall any extensions on the list at the bottom of Socket's report, run a full antivirus scan, and avoid unnecessary add-ons from unknown publishers. Digital Trends suggests opening chrome://extensions, removing anything you don't recognise, especially search, safe-search or PDF tools, and then checking under Settings > Search engine that the default is the one you chose.
BleepingComputer says it contacted Google for comment and had not received a response by publication.
Mia's take: The detail that should change habits is the one with no permissions at all. Most of us have learned to be wary of an add-on that wants to read every site we visit, but an extension that asks for nothing can still decide where every search goes. So I'd treat any "PDF converter" or "safe search" tool you don't remember choosing as unwelcome, whatever it asked for at install. Fewer add-ons is a boring answer, but it's the one that works.
Reporting notes