319 Chrome extensions with 13.4 million installs hijack searches via a proxy
The proxy can send searches to phishing pages or malicious downloads without any change to the extensions themselves.
Socket researcher John Tuckner has documented a browser-hijacking campaign built from 319 Chrome extensions that together claim 13.4 million installs. The add-ons, disguised as PDF converters, safe-search and AI search tools, quietly swap the default search provider and push queries through an operator-run proxy that collects partner referral fees from Bing and Yahoo. Socket's report adds 264 newly identified extensions and 8.7 million users to the 57 extensions and 6 million users it flagged in April 2025. The proxy can change where searches end up without any update to the extension, so the same query may land on a phishing page or malicious download later. Most of the listed extensions had been removed from the Chrome Web Store by publication, but new ones keep appearing, and users are advised to uninstall them and run a full antivirus scan.
Why it matters
Users who installed these add-ons may have their default search silently rerouted, and the destination can change at any time without a visible update. Because the redirects are controlled from the operator's side, a search that looked safe yesterday may lead somewhere harmful today. Most of the listed extensions have already been removed from the Chrome Web Store, but new ones keep appearing, so the risk to anyone still carrying one remains.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.