Threat intel

John Tuckner of Socket has published research on 319 Chrome extensions, with about 13.4 million reported installs over roughly a decade, that take over the browser's default search engine. Every search typed into the address bar goes first to a server run by the extension's operator, which forwards it to Yahoo or Bing with a partner tag attached and collects a referral payment. The extensions posed as PDF converters, manual finders, "safe search" helpers and AI search tools. Coverage of the report appeared on October 29 and 30, 2026.

With 13.4 million installs, any organisation that lets staff add extensions freely should check its browsers. Most of the extensions were unlisted on the Chrome Web Store, so they never showed up in store search and were reached through ads instead. The operator sees every query, often tied to an install identifier, and Socket points out that the same proxy could send chosen searches to a phishing or malware page at any time without an extension update. Socket says it found no evidence that this had happened.

How it works

Chrome lets an extension replace the default search engine through the chrome_settings_overrides key in its manifest.json. Inside it, a search_provider block names the engine and gives a search_url containing {searchTerms}, with is_default set to true. Chrome then sends anything the user types in the address bar that is not a web address to that URL. If the block also sets a suggest_url, the browser sends the partial text as the user types, to fetch suggestions.

None of this needs code. Socket's example, Safe Game Search, is a manifest file and three icons, with no background worker, no content scripts, no toolbar button and no requested permissions. Google's documentation says Chrome shows a confirmation dialog only when an override is combined with other capabilities or permissions, so an extension that changes the search setting alone can skip it. Socket says the install prompt users do see mentions the search change but does not explain where their searches will travel.

The money comes from search syndication. Yahoo and Microsoft pay partners that bring them search traffic, and they know whom to pay from parameters on the query: hspart and hsimp for Yahoo, PC and PTAG for Bing. The operator's proxy adds its own tags and passes the query on, so the user still gets normal looking results and has little reason to suspect anything.

The proxy also decides where each search ends up. Socket ran six identical searches through one extension, Predator Search, which has about 50,000 users. They ended in four different places: Yahoo with partner tags, a different landing page, a longer redirect chain that finished at Yahoo, and a Cloudflare error page. Because routing is decided on the server, a store review of the package cannot show what it will do next week.

What attackers are doing

The report extends Tuckner's April 2025 research on 57 hidden extensions with about 6 million users, adding 264 extensions with about 8.7 million users.

Socket tied 200 of the 319 extensions, with about 5.7 million users, to identifiable operators, and could not name the operators behind the other 119, with about 7.8 million users. Reported clusters include:

• SecuryBrowse, 58 security themed extensions with about 4.9 million users, operator unknown.
• Intango LTD, 111 extensions with about 2.2 million users. Socket says Intango's domains often stay online after its extensions are pulled.
• Bing-Search, 37 extensions with about 2.2 million users that share Bing partner tags. CyberInsider reports that 15 supposedly separate publishers updated them within the same four days in June 2026.

Installs came from paid advertising. Ads on networks including Google Ads, and Bidbrain for the Bing-Search cluster, led to branded install pages, often through pop-under and pop-over ads on smaller sites. Most reports describe the extensions as unlisted Web Store items reachable only by direct link; Digital Trends describes most as distributed outside the store.

BleepingComputer and Digital Trends report that most of the flagged extensions had been removed from the Chrome Web Store by publication, and that new ones keep appearing. Removal from the store does not uninstall an extension from browsers that already have it. Google had not answered BleepingComputer's request for comment.

For a business the exposure is the search history itself: queries about customers, deals, health, finances and internal project names, sent to a third party that can link them to one user over time.

What to do

1. Find affected browsers

Socket published the full list of extension IDs with its report. Compare it against your inventory:

• With Chrome Enterprise Core (formerly Chrome Browser Cloud Management), open the Google Admin console and go to Devices, Chrome, Reports, Apps and extensions usage. Export it as CSV and match the App ID column against Socket's list. Chrome browser reporting must be on, and new data can take up to 24 hours to appear.
• On a single machine, open chrome://settings/search. When an extension controls the search engine, Chrome says so on that page and names the extension.
• For machines outside management, look in each profile's Extensions folder under %LOCALAPPDATA%\Google\Chrome\User Data\ for a manifest.json containing chrome_settings_overrides with a search_provider block. A manifest-only extension with that key and no permissions matches the pattern in Socket's report.

2. Remove what you find

Push the matching IDs in the ExtensionSettings policy with "installation_mode": "removed", which uninstalls an extension already present and stops it being reinstalled. Adding an ID to ExtensionInstallBlocklist instead disables an installed extension so the user cannot turn it back on. Check the result at chrome://policy on a test machine before rolling out. Users without management can remove the extension at chrome://extensions and then reset the search engine under Settings, Search engine.

3. Lock the default search provider

Set DefaultSearchProviderEnabled to true, with DefaultSearchProviderName and DefaultSearchProviderSearchURL pointing at the engine you approve, as mandatory policies. A mandatory policy fixes the engine so users cannot change it. Google does not spell out how this interacts with an extension override, so test it on a pilot group with one of the reported extensions installed and confirm at chrome://settings/search that the page shows the engine as set by policy, not by the extension.

4. Move to an allowlist

Set ExtensionInstallBlocklist to * and list approved IDs in ExtensionInstallAllowlist. If you already use ExtensionSettings, put the same rules there, because ExtensionSettings takes precedence over the separate blocklist and allowlist policies. A deny by default list stops the next batch of unlisted search extensions without anyone having to track each new ID.

If users of an affected browser searched for customer names, internal systems or anything they would not want a third party to keep, treat those queries as disclosed. Removing the extension stops new collection only.

The wider lesson

These extensions passed store review because there was almost nothing to review: a manifest and a server address. The behaviour that matters happens on the operator's server, after review, and can change at any time. For managed fleets, review the settings an extension changes as well as the code it runs: an inventory that flags every extension with a chrome_settings_overrides key flags this whole class of extension without anyone reading its code.

Our safeguarding and hardening work sets browser policy, extension allowlists and a locked search provider across Chrome fleets, and our security operations team can run the extension inventory against Socket's list for you. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Socket, Searchjacked, BleepingComputer, Malwarebytes, eSecurityPlanet, CyberInsider, Digital Trends, Cybernews, SecurityLab, Chrome developers, Overriding Chrome settings, Google Chrome Enterprise, Apps and extensions usage, Google Chrome Enterprise ExtensionSettings help.