319 Chrome Extensions Quietly Rerouted Searches for 13.4 Million Users

A sprawling family of Chrome extensions has been tied to search hijacking on a scale rarely seen in the browser ecosystem: 319 add-ons with a combined footprint of roughly 13.4 million installs accumulated since 2016. The extensions posed as PDF converters, manual finders, "safe search" tools and AI search helpers. What they actually did was simpler and quieter: replace the browser's default search engine with a proxy controlled by the operators, so that every query took a detour before landing on Yahoo or Bing.

One caveat up front. The 13.4 million figure is cumulative across years of activity, not a count of people currently affected. The most recent batch analysed covers 264 extensions with about 8.7 million installs; the rest comes from earlier waves.

What happened

The trick relies on a legitimate Chrome feature. An extension's manifest can declare a chrome_settings_overrides.search_provider entry, which tells the browser to use a new default search engine. That is all these extensions needed. Several of the analysed packages contained nothing but a manifest file and three icons: no background service worker, no content scripts, no toolbar button, and no permission requests beyond the search override.

Chrome does show an installation prompt warning that the extension will change search settings. It does not, however, say where the queries will go. That gap is what the operation exploited. A reviewer checking permissions sees nothing alarming, yet an outside server now sits between the user and their search results.

The money comes from search syndication. Yahoo and Bing run partner programmes that share advertising revenue with whoever supplies the traffic, and tracking parameters appended to each redirected query identify which partner gets paid. Routing searches through a proxy rather than straight to the search engine gives the operators two extra things: full visibility into what people search for, and server-side control over where each query ends up.

That control was observed directly in one extension, "Predator Search". Six identical queries sent through its proxy produced four different results: standard Yahoo results, alternative landing pages, an additional redirect chain, and an error page. The extension never changed; the behaviour was decided entirely on the server.

Why it matters

For now, the traffic analysed was mostly referral-tagged search redirection, not phishing or malware delivery. Delivering something nastier remains a possible escalation rather than an established outcome, and that distinction is worth keeping.

But the privacy exposure is real today. Search queries reveal health concerns, financial trouble, confidential work projects and personal interests. Because the intermediary receives the query first, a results page that looks perfectly normal says nothing about whether the request took a direct route. In a corporate environment, that means internal project names, customer names and product codenames may have been passing through a third party's logs.

The distribution model also explains how it stayed under the radar. Most of the extensions were unlisted in the Chrome Web Store: reachable via a direct link, invisible to store search. Paid advertising, including popovers and popunders, drove users to landing pages pitching handy-looking tools, with "Continue" and "Install" buttons leading straight to the extension page. For a single landing domain, roughly 400 ads ran from one verified advertiser account.

Shared infrastructure ties the whole thing together. One cluster of about 111 extensions and 2.2 million installs traces back to a single company. Another, branded SecuryBrowse, covers 58 extensions and roughly 4.9 million users. A newer Bing-focused group of 37 extensions shipped coordinated updates across supposedly unrelated publishers, which is hard to explain without a common operator. Cross-referencing store listings, privacy policies, ad transparency records and internet-scan data exposed relationships that different extension names and publisher brands were designed to hide.

A final point: the domains survive the extensions. When a listing is removed, the proxy infrastructure often stays online, waiting for the next package. Tracking the operator's infrastructure gives a far better picture than checking whether one listing is still live.

What to do

For individual users:

• Open Chrome's extensions page and remove anything you do not recognise or no longer use.
• In Settings, under Search engine, make sure the default is the one you chose. If a "Safe Search", "PDF Search" or similar entry is there, delete it.
• Be sceptical of extensions found through ads rather than through a store search.

For organisations:

• Treat search-engine overrides as a signal in their own right. Extension review processes that look only at permissions will pass these packages every time.
• Enforce an extension allowlist through managed browser policy and pin the default search provider centrally.
• Investigate unexplained search redirects on endpoints. Look in proxy and DNS logs for the indicators below.
• Hunt by infrastructure, not by extension ID. The listing may be gone; the domains probably are not.

Browser configuration rarely gets the attention that servers and perimeters do, yet it is a direct path to what employees type all day. Our penetration testing engagements include workstation and browser hardening checks: whether extension allowlists are actually enforced, whether the search provider can be silently replaced, so that gaps like this show up in a report before they show up in someone else's logs.

Indicators of compromise

Domains are defanged. Re-fang them only inside your threat intelligence platform or SIEM.