# 319 Chrome Extensions Hijacked Searches for 13.4 Million Installs

- URL: https://usa-24.com/chrome-extensions-hijacking-searches/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T12:00:59.320Z
- Updated: 2026-10-30T12:00:59.327Z
- Topics: Chrome Extensions, Browser Security, Search Hijacking, Online Privacy, Socket

> Socket says 319 Chrome extensions rerouted default searches through operator-run proxies to collect Bing and Yahoo referral payments, with 13.4 million reported installs.

## Key takeaways

- Socket identified 319 Chrome extensions that reroute default searches through operator-controlled proxies to collect Bing and Yahoo referral payments.
- The extensions have a reported 13.4 million installs accumulated over about a decade, which is not a count of browsers affected today.
- Many of the add-ons pose as PDF converters, safe search tools and AI search helpers, and they are promoted through ads on websites.
- In one test, six identical searches run through the Predator Search extension ended up in four different places.
- Most flagged extensions were removed from the Chrome Web Store at publication, but researcher John Tuckner says new ones keep appearing.

Searches typed into Google Chrome can take a detour through a stranger's server before they reach a results page. Security firm Socket says 319 Chrome extensions have been doing exactly that, collecting referral payments from Bing and Yahoo while users assume their searches go where they chose. The extensions have a reported 13.4 million installs accumulated over about a decade.

Socket researcher John Tuckner published the findings on October 29, 2026, in a report called Searchjacked. Security and consumer tech outlets covered it on October 29 and 30, including [BleepingComputer](https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/), which reported details of how the routing works.

## How Chrome extensions hijacking searches reroutes queries

The extensions pose as PDF converters, manual finders, safe search tools and AI search helpers. Socket says they are hosted on the Chrome Web Store but are unlisted, so they do not show up in ordinary store searches. Instead, they are pushed through shady advertisements on websites. [Cybernews](https://cybernews.com/security/millions-of-chrome-users-installed-extensions-hijacking-searches/) describes one entry point this way: "a click on a 'PDF converter' ad installs a Chrome extension that does nothing but route search queries through a stranger's server."

The technical trick is simple. Chrome's built-in chrome_settings_overrides setting lets an extension replace the default search provider, and many of these add-ons need very little code to do it. Once the default is swapped, every search passes through the operator's server before it reaches Bing or Yahoo. Socket says the people behind the extensions can see that search history, often linked to a unique identifier.

[Digital Trends](https://www.digitaltrends.com/computing/your-search-engine-could-be-hijacked-by-a-chrome-extension-that-barely-does-anything/) reported a test that shows how opaque the routing is. Six identical searches run through the Predator Search extension ended up in four different places, even though the extension itself never changed. In BleepingComputer's report, Tuckner put it this way: "The extension never changed; the proxy chose each destination as the search came in."

The bigger concern is what the operator could do later. Socket researchers warn that an operator can wait for data to accumulate and for targets to surface, then redirect searches to malicious results or to landing pages used for phishing or malicious downloads. The reporting does not say that such redirects have been observed. The risk described is capability, not a documented incident.

## Which extensions were flagged and how many users they reached

Intango LTD is tied to 111 of the extensions. A separate, unattributed cluster called SecuryBrowse includes 58 extensions with security-themed branding, and those reached about 4.9 million users. The operators behind Intango LTD and the SecuryBrowse cluster are the only ones the sources identify, and even those attributions are limited.

The new report builds on Tuckner's April 2025 finding of 57 extensions with about 6 million users. It identifies 264 additional add-ons with another 8.7 million users, according to [Mezha](https://mezha.net/eng/news/mezha-70c03fdcf5353202c5d98a77_319_chrome_extensions). The groups are easier to compare in a table:

| Group | Extensions | Reported users |
|---|---|---|
| April 2025 finding | 57 | About 6 million |
| Additional add-ons in current report | 264 | About 8.7 million |
| SecuryBrowse cluster (unattributed) | 58 | About 4.9 million |
| Intango LTD-linked | 111 | Not stated in sources |

The groups overlap in ways the reporting does not fully explain, and the extension counts do not add up cleanly to 319. Treat the table as a guide to scale, not as a ledger.

Scale needs one more caveat. The 13.4 million figure is a cumulative install count across roughly a decade. [DigitBin](https://www.digitbin.com/chrome-extensions-hijacking-searches/) notes that it is a reported install count, not a verified count of active users, and it does not tell readers how many people are affected today.

Socket also reported a separate Firefox campaign that uses fake crypto wallets to drain funds, according to [Piunika Web](https://piunikaweb.com/2026/10/30/13-million-users-chrome-search-hijacking-firefox-wallet-stealers/). Crypto theft keeps drawing attackers, a pattern visible in the [Binance hack](https://usa-24.com/binance-hack-crypto-theft-withdrawals/) story.

## Why the Chrome Web Store did not stop them

Piunika Web quotes Tuckner on the store itself: "The Chrome Web Store hasn't kept up." The rest of that remark adds: "Even if extensions are taken down, there are new domains and lures popping up quickly after."

BleepingComputer reports that most of the extensions were removed from the store when the report was published. Tuckner said new ones continue to appear. That pattern is the core problem, since takedowns clear the current batch while new listings and new domains take its place.

Chrome does display a search-change prompt during installation, according to [GBHackers](https://gbhackers.com/chrome-extensions-hijacking/). That warning does not explain the proxy infrastructure behind the extension or the routing decisions made afterward. A user who clicks through the prompt has no way to see where their queries end up.

The coverage reviewed for this story does not include a statement from Google about enforcement or about how many of these listings remain live. That is the most important gap for readers who want to know whether the store is cleaner today.

## Who gains, who loses and how this compares

The beneficiaries are the operators and the referral networks that get paid for each redirected search. Users lose privacy and control over their default search. Bing and Yahoo pay for that traffic, which means the referral system is being fed by installs that users never meant to make.

The method is old. Search hijacking has appeared in toolbars and adware for years, and Socket's April 2025 finding was an earlier version of this same playbook. The newer numbers suggest the operation expanded after that first report. Stolen data also has its own market, and the [k0t access broker case](https://usa-24.com/k0t-fortigate-credentials-theft/) involved 70,000 credentials taken from VPN and firewall devices.

The same day, CISA added GitLab flaw CVE-2026-97229, which carries a CVSS score of 10.0, to its Known Exploited Vulnerabilities catalog, as reported by [Cyber Security News](https://cybersecuritynews.com/gitlab-integer-overflow-vulnerability-exploited/). That urgency applies to self-managed GitLab operators. The Chrome issue reaches any user who installed the wrong add-on.

## How to check Chrome and remove hijacked search extensions

Start with the browser you use every day, then check any other devices you sign into.

1. Open chrome://extensions and review everything listed. Remove any extension you do not recognize, especially PDF converters, "safe search" tools and AI search add-ons you do not remember installing.
2. Check your default search engine in Chrome's settings, in the search engine section. If it shows a provider you did not choose, switch it back to one you know.
3. If you use Chrome sync, check chrome://extensions on your other computers and phones too, because an extension may have followed your profile.
4. Avoid installing extensions from ads or pop-up offers. Go directly to a known publisher's site instead.
5. Report suspicious extensions through the Chrome Web Store's reporting option.

Assume that searches made while a suspicious extension was active may have been visible to its operator. If you searched for health, legal or financial information during that window, consider changing the passwords on any accounts tied to those searches.

## What comes next for Chrome search hijacking

Three things will show whether this campaign is contained. The first is whether Google publishes enforcement numbers or explains how it screens unlisted extensions that spread through ads. The second is whether Socket or other researchers identify operators beyond Intango LTD and the SecuryBrowse cluster. The third is whether the referral payments from Bing and Yahoo change once the extensions are gone.

If the pattern holds, the next wave will look like this one: a new batch of tools with plausible names, a fresh set of ads and a reminder that the default search engine is one of the settings most people never check.

## Frequently asked questions

### How do I know if a Chrome extension is hijacking my searches?

Open chrome://extensions and look for PDF converters, safe search tools or AI search add-ons you do not remember installing. Then check Chrome's search engine setting to confirm it still points to the provider you chose. A default search engine you did not select is the clearest sign of hijacking.

### Are the 319 Chrome extensions still installed?

According to BleepingComputer, most of the extensions were removed from the Chrome Web Store when Socket published its report on October 29, 2026. How many remain installed on user devices has not been established. Tuckner said new extensions continue to appear.

### Did these extensions steal passwords or bank details?

The reporting does not establish that. Socket's main concern is search queries and referral revenue, and the sources do not show that user data has been sold or abused beyond referral payments. Searches can still reveal health, legal, financial and personal information.

### What does the 13.4 million install figure mean?

It is a cumulative count of reported installs across roughly a decade. It is not a count of browsers affected today, and it is not a verified number of active users. The true number of people affected right now is unknown.

## Sources

1. [Chrome extensions with 13.4 million installs caught hijacking searches — BleepingComputer](https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/)
2. [Hidden Chrome extensions racked up 13M+ installs, hijacking user searches for profit — Cybernews](https://cybernews.com/security/millions-of-chrome-users-installed-extensions-hijacking-searches/)
3. [Your search engine could be hijacked by a Chrome extension that barely does anything — Digital Trends](https://www.digitaltrends.com/computing/your-search-engine-could-be-hijacked-by-a-chrome-extension-that-barely-does-anything/)
4. [319 Chrome extensions with 13.4 million reported installs hijacked searches — Mezha](https://mezha.net/eng/news/mezha-70c03fdcf5353202c5d98a77_319_chrome_extensions)
5. [Investigations reveal a 13-million-user search hijacking ring on Chrome and lookalike crypto drainers on Firefox — Piunika Web](https://piunikaweb.com/2026/10/30/13-million-users-chrome-search-hijacking-firefox-wallet-stealers/)
6. [319 Chrome Extensions Hijacked Searches for 13.4M Users — Gblock](https://www.gblock.app/articles/chrome-extensions-13-million-installs-search-hijacking-2026)
7. [Chrome Extensions Hijacking Searches: 13.4M Installs Found — DigitBin](https://www.digitbin.com/chrome-extensions-hijacking-searches/)
8. [319 Suspicious Chrome Extensions Hijack Default Search Settings Without Sensitive Permissions — GBHackers](https://gbhackers.com/chrome-extensions-hijacking/)
9. [CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks — Cyber Security News](https://cybersecuritynews.com/gitlab-integer-overflow-vulnerability-exploited/)