GoKawiil319 Chrome extensions with 13.4 million installs hijacked search traffic
Security researcher John Tuckner of Socket documented 319 Chrome extensions, collectively installed 13.4 million times, that silently override users' default search engine and reroute queries through proxy servers before landing on Bing or Yahoo. This builds on his April 2025 finding of 57 such extensions with 6 million users, adding 264 newly identified ones covering another 8.7 million installs. The extensions masquerade as PDF converters, search tools, and similar utilities, and are unlisted on the Chrome Web Store, spreading instead through ads on other websites.
GoKawiil's interpretation of the reporting above, not reported fact.
The campaign shows how little code is needed to abuse Chrome's built-in settings-override feature, since some extensions contain only a manifest and icons with no requested permissions, making detection harder. Because the extensions are hidden from Chrome Web Store search yet still hosted there, it raises questions about Google's ability to police unlisted listings promoted through external advertising. Socket suggests the operators are collecting referral payments from Bing and Yahoo's syndication programs, and notes the behavior sits in a long-standing gray zone between unwanted software and outright malware.
- 319 Chrome extensions with a combined 13.4 million installs were found hijacking default search settings.
- The extensions reroute searches through proxy servers to generate ad revenue via Bing and Yahoo syndication partnerships.
- They remain hosted but unlisted on the Chrome Web Store, spreading mainly through deceptive ads rather than store search.
Malwarebytes Premium Security Software — With browser hijacking campaigns like this sneaking malicious extensions past millions of users, real-time malware protection is essential. Malwarebytes Premium actively scans for and blocks suspicious browser extensions and hijackers before they can reroute your searches or steal ad revenue through your traffic.
See Malwarebytes Premium Security Software on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-29
Published there as: “Chrome extensions with 13.4 million installs caught hijacking searches”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.