Chrome extensions with 13.4 million installs caught hijacking searches

What it is

Socket researcher John Tuckner reported 319 Chrome extensions with 13.4 million combined installs that replace the default search engine and send queries through operator-controlled proxies. The proxies forward users to Bing or Yahoo under a syndication partner ID, so the operators collect referral payments. The report adds 264 extensions (8.7 million users) to the 57 extensions (6 million users) Tuckner found in April 2025. The extensions pose as PDF converters, manual finders, safe search and AI search tools.

How it works

The extensions use Chrome's built-in chrome_settings_overrides manifest setting to swap the search provider. One analyzed example has only a manifest and icons, with no background scripts, content scripts or requested permissions. There is little code or permission surface for a store review to flag.

The extensions are hosted on the Chrome Web Store but unlisted, so they do not show up in store search. They are promoted through ads on websites instead.

The proxy decides where each search lands, and the extension never changes. Tuckner ran six identical searches through the Predator Search extension and got four outcomes:

• Straight to Yahoo with partner tags (hspart=sz&hsimp=yhs-026).
• A landing page on searchlio.net.
• A hop through searchtosearch.com to mcftink.com, then Yahoo.
• A Cloudflare non-responsive error page.

Tuckner warns the destination can change at any time without an extension update, including to phishing sites or malicious downloads. Tuckner describes the referral revenue as a "profitable watering hole" while the operator waits for targets to surface. Today the observed behavior is revenue generation only.

Preconditions / Affected

Anyone with one of the listed extensions installed. The largest recently active clusters:

• "Bing-Search": 37 extensions, 2.2 million users, often promoted through Bidbrain ads.
• "SecuryBrowse": 58 extensions, 4.9 million users, with security-themed names such as Fire Shield, Securify and WatchTower.

What to do

• Check installed extensions against the full list at the bottom of Socket's report, and uninstall matches.
• Run a full AV scan, as the page advises.
• Avoid unnecessary add-ons from unknown publishers.
• To audit your own fleet, an extension whose manifest declares chrome_settings_overrides for search is the relevant trait. The page does not give a detection query, so this is an inference from the mechanism.

Caveats

Tuckner says most of the extensions had been removed from the Web Store by publication, but new ones keep appearing, so the list will lag. BleepingComputer had asked Google for comment and had no reply when the article was published. The install totals are reported figures.