Searches typed into Google Chrome can take a detour through a stranger's server before they reach a results page. Security firm Socket says 319 Chrome extensions have been doing exactly that, collecting referral payments from Bing and Yahoo while users assume their searches go where they chose. The extensions have a reported 13.4 million installs accumulated over about a decade.
Socket researcher John Tuckner published the findings on October 29, 2026, in a report called Searchjacked. Security and consumer tech outlets covered it on October 29 and 30, including BleepingComputer, which reported details of how the routing works.
How Chrome extensions hijacking searches reroutes queries
The extensions pose as PDF converters, manual finders, safe search tools and AI search helpers. Socket says they are hosted on the Chrome Web Store but are unlisted, so they do not show up in ordinary store searches. Instead, they are pushed through shady advertisements on websites. Cybernews describes one entry point this way: "a click on a 'PDF converter' ad installs a Chrome extension that does nothing but route search queries through a stranger's server."
The technical trick is simple. Chrome's built-in chrome_settings_overrides setting lets an extension replace the default search provider, and many of these add-ons need very little code to do it. Once the default is swapped, every search passes through the operator's server before it reaches Bing or Yahoo. Socket says the people behind the extensions can see that search history, often linked to a unique identifier.
Digital Trends reported a test that shows how opaque the routing is. Six identical searches run through the Predator Search extension ended up in four different places, even though the extension itself never changed. In BleepingComputer's report, Tuckner put it this way: "The extension never changed; the proxy chose each destination as the search came in."
The bigger concern is what the operator could do later. Socket researchers warn that an operator can wait for data to accumulate and for targets to surface, then redirect searches to malicious results or to landing pages used for phishing or malicious downloads. The reporting does not say that such redirects have been observed. The risk described is capability, not a documented incident.
Which extensions were flagged and how many users they reached
Intango LTD is tied to 111 of the extensions. A separate, unattributed cluster called SecuryBrowse includes 58 extensions with security-themed branding, and those reached about 4.9 million users. The operators behind Intango LTD and the SecuryBrowse cluster are the only ones the sources identify, and even those attributions are limited.
The new report builds on Tuckner's April 2025 finding of 57 extensions with about 6 million users. It identifies 264 additional add-ons with another 8.7 million users, according to Mezha. The groups are easier to compare in a table:
| Group | Extensions | Reported users |
|---|---|---|
| April 2025 finding | 57 | About 6 million |
| Additional add-ons in current report | 264 | About 8.7 million |
| SecuryBrowse cluster (unattributed) | 58 | About 4.9 million |
| Intango LTD-linked | 111 | Not stated in sources |
The groups overlap in ways the reporting does not fully explain, and the extension counts do not add up cleanly to 319. Treat the table as a guide to scale, not as a ledger.
Scale needs one more caveat. The 13.4 million figure is a cumulative install count across roughly a decade. DigitBin notes that it is a reported install count, not a verified count of active users, and it does not tell readers how many people are affected today.
Socket also reported a separate Firefox campaign that uses fake crypto wallets to drain funds, according to Piunika Web. Crypto theft keeps drawing attackers, a pattern visible in the Binance hack story.
Why the Chrome Web Store did not stop them
Piunika Web quotes Tuckner on the store itself: "The Chrome Web Store hasn't kept up." The rest of that remark adds: "Even if extensions are taken down, there are new domains and lures popping up quickly after."
BleepingComputer reports that most of the extensions were removed from the store when the report was published. Tuckner said new ones continue to appear. That pattern is the core problem, since takedowns clear the current batch while new listings and new domains take its place.
Chrome does display a search-change prompt during installation, according to GBHackers. That warning does not explain the proxy infrastructure behind the extension or the routing decisions made afterward. A user who clicks through the prompt has no way to see where their queries end up.
The coverage reviewed for this story does not include a statement from Google about enforcement or about how many of these listings remain live. That is the most important gap for readers who want to know whether the store is cleaner today.
Who gains, who loses and how this compares
The beneficiaries are the operators and the referral networks that get paid for each redirected search. Users lose privacy and control over their default search. Bing and Yahoo pay for that traffic, which means the referral system is being fed by installs that users never meant to make.
The method is old. Search hijacking has appeared in toolbars and adware for years, and Socket's April 2025 finding was an earlier version of this same playbook. The newer numbers suggest the operation expanded after that first report. Stolen data also has its own market, and the k0t access broker case involved 70,000 credentials taken from VPN and firewall devices.
The same day, CISA added GitLab flaw CVE-2026-97229, which carries a CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog, as reported by Cyber Security News. That urgency applies to self-managed GitLab operators. The Chrome issue reaches any user who installed the wrong add-on.
How to check Chrome and remove hijacked search extensions
Start with the browser you use every day, then check any other devices you sign into.
- Open chrome://extensions and review everything listed. Remove any extension you do not recognize, especially PDF converters, "safe search" tools and AI search add-ons you do not remember installing.
- Check your default search engine in Chrome's settings, in the search engine section. If it shows a provider you did not choose, switch it back to one you know.
- If you use Chrome sync, check chrome://extensions on your other computers and phones too, because an extension may have followed your profile.
- Avoid installing extensions from ads or pop-up offers. Go directly to a known publisher's site instead.
- Report suspicious extensions through the Chrome Web Store's reporting option.
Assume that searches made while a suspicious extension was active may have been visible to its operator. If you searched for health, legal or financial information during that window, consider changing the passwords on any accounts tied to those searches.
What comes next for Chrome search hijacking
Three things will show whether this campaign is contained. The first is whether Google publishes enforcement numbers or explains how it screens unlisted extensions that spread through ads. The second is whether Socket or other researchers identify operators beyond Intango LTD and the SecuryBrowse cluster. The third is whether the referral payments from Bing and Yahoo change once the extensions are gone.
If the pattern holds, the next wave will look like this one: a new batch of tools with plausible names, a fresh set of ads and a reminder that the default search engine is one of the settings most people never check.
