319 Chrome Extensions Hijacked Searches, Socket Says

If you use Chrome, it is worth checking your extensions today. Security firm Socket says it has found 319 browser extensions that quietly take over the browser’s search engine, capture every query and route it through their operators’ servers to collect referral payments from Yahoo and Bing. The full list of affected extensions is at the bottom of Socket’s report, published on 29 October by researcher John Tuckner.

The headline number needs care. Socket says the 319 extensions were “installed by roughly 13.4 million users across a decade of time”, with the oldest dating back to 2016. That is a total built up across hundreds of extensions over about ten years, many of which have since gone. It is not a count of 13.4 million people running them today.

How to check your browser

The quickest check takes a couple of minutes:

Open the extensions page. Type chrome://extensions into the address bar and look through everything installed. Compare the names against the list in Socket’s report.
Remove anything you cannot account for. Socket says these extensions pose as PDF converters, manual finders, “safe search” tools and AI search helpers. If one matches, or you have no memory of installing something, click Remove.
Check your search engine. In Chrome’s Settings, open the Search engine section and make sure the default is one you chose. If an extension has taken over, Chrome usually says so there.
Watch your results. If searches pass through an unfamiliar web address before reaching a results page, something is redirecting them.
Scan the computer. BleepingComputer, which reported on Socket’s findings, also advises running a full antivirus scan.

Organisations can do the same check across managed browsers. Tuckner wrote on X that while people often tell him their parents have installed these search hijackers, “they have also ended up in nearly every large organization I’ve worked with”.

What Socket found

Socket’s own post on X summed up the scheme: the extensions “promise PDF tools and safer searches, then take over your search engine”. The new report expands Tuckner’s April 2025 research, which found 57 extensions with 6 million users. It adds 264 newly identified extensions that Socket says affected another 8.7 million users.

Many of the extensions need almost no code. Chrome lets an extension replace the default search provider through a built-in setting, so some samples Socket examined have no permissions, no background code, no scripts that run on web pages and no user interface at all. Chrome does show a prompt when an extension changes the search provider at installation, but Socket says it “will not clearly state where your searches end up going”.

Socket says most of the extensions are unlisted in the Chrome Web Store, so they stay hidden from people searching the store. Instead they are pushed through adverts on websites, including Google Ads and pop-ups.

The firm attributes 200 of the extensions, with about 5.68 million users, to named operators. Intango, which Socket says makes the Lumio browser, accounts for 111 extensions with about 2.19 million installs. Free Planet VPN accounts for a single extension with 2 million users. Socket also names Tightrope Interactive, System1, Perion Network and ValidClick/Inuvo, each with far smaller numbers. The other 119 extensions, with about 7.76 million users, come from operators Socket could not identify. They include a “SecuryBrowse” wave of 58 extensions with about 4.9 million users and a “Bing-Search” cluster of 37 extensions with about 2.2 million.

BleepingComputer reported that, according to the researcher, most of the extensions had been removed from the Chrome Web Store by the time the report was published, though new ones keep appearing. At least one that Socket names, Predator Search, was still available in the store with 50,000 users on the afternoon of 29 October. BleepingComputer said Google had not responded to its request for comment.

Why search hijackers are more than a nuisance

Extensions like these have long sat in a grey zone between unwanted software and malware. Their business is advertising money: each search earns a small payment when it reaches Yahoo or Bing under the operator’s partner ID. That makes it tempting to treat them as an irritation rather than a threat.

Socket’s argument is that the real risk is control. Because every query passes through a server the operator runs, the operator decides where each search ends up, and can change that at any time without updating the extension. “Every search you make is captured,” the report says, and the results “could show a phishing page, a fake results page, or a malware lure selectively”. In one test, six identical searches through the Predator Search extension ended in four different places: straight to Yahoo, a landing page on another site, a detour through two more domains before Yahoo, and an error page. The extension itself never changed.

Socket is careful about what it has proved. “It is only an assumption that these redirects could be malicious,” the report says. The company still argues that extensions built only to capture search queries “should be considered malicious by definition”, because the user never knowingly agreed to send every query to a third party.

That is the same weakness behind other browser threats TSN has covered, from a wallet extension that leaked users’ private keys to a tampered website script that swapped crypto deposit addresses. Software people trust can change behaviour long after installation, as the malicious LiteLLM release on PyPI showed for developers. “The Chrome Web Store hasn’t kept up,” Socket says, adding that even when extensions are taken down, new domains and lures appear quickly. For users, checking the extension list now and then is the most reliable fix.