Security firm Socket says a long-running set of Chrome extensions reached roughly 13.4 million users across a decade by posing as small utility tools while taking over search routing.
In a report published Oct. 29, Socket researcher John Tuckner said 319 extensions changed Chrome’s default search provider, routed search queries through proxy servers controlled by operators, and then sent users to Yahoo or Bing with partner referral tags. The operators could earn referral payments while gaining access to the search queries passing through their servers.
The extensions were advertised as tools for tasks such as finding manuals, converting PDFs, safer search, and AI search. Socket said many were unlisted in the Chrome Web Store, meaning a direct link could open the listing but the extension would not appear in normal store searches.
The new report expands earlier Secure Annex research from April 2025 that tracked 57 related Chrome extensions with almost 6 million users. Socket said the broader count now includes 264 newly identified extensions and roughly 8.7 million more users.
The technical trick was small
Google’s Chrome developer documentation says extensions can use chrome_settings_overrides to override selected Chrome settings, including the search provider. Socket said some extensions needed almost no executable code; one analyzed example contained a manifest and icons.
Chrome’s own help documentation tells users to check which settings an extension changes before installing and says an extension that changes the new tab page and default search engine triggers a confirmation. Google’s developer documentation adds that changing only one setting, without requesting other capabilities or permissions, does not trigger that confirmation dialog. When a prompt appears, Socket’s concern is that it does not clearly show the full path queries take after the search provider changes.
Why search routing is sensitive
Search terms can expose health worries, financial problems, workplace research, personal interests, and other private context. Malwarebytes, covering Socket’s report, noted that queries may be associated with a unique identifier, which could allow activity to be tied over time.
Socket also described a Predator Search extension that sent six identical searches to four different destinations, including Yahoo with partner tags, intermediary sites, and a Cloudflare error page.
Socket warned that a proxy operator can alter destinations without updating the extension. Malwarebytes said Socket did not report evidence that the extensions had been used to send users to phishing or malware pages.
Not all were still available
BleepingComputer reported on Oct. 29 that most of the extensions had been removed from the Chrome Web Store by publication and that it had contacted Google for comment without receiving a response by then. Socket said new domains and lures continue to appear, so removals alone may not end the pattern.
A removed store listing may stop new installs, but it does not replace the need to review browsers that already have extensions installed.
What Chrome users and businesses should check
For individual Chrome installations, the immediate check is installed extensions and search settings, not just antivirus warnings. Google’s support documentation says removing an extension returns changed settings to their previous state.
Open chrome://extensions and remove extensions that are unfamiliar, unused, or no longer trusted.
Open Chrome settings, check Search engine, and look for a notice saying an extension controls the setting.
Run Chrome Safety Check and consider an anti-malware scan if search results keep redirecting or unwanted extensions reappear.
For managed devices, review extension IDs against Socket’s list and restrict ad-driven utility extensions that do not have a clear business purpose.
Security teams should treat browser extensions as software running inside the browser, especially when an add-on is unlisted, installed after an advertisement, or unrelated to a real business need.
The broader lesson from the report
The useful takeaway is that “available in an official store” is not a full trust signal. Google says it reviews Chrome Web Store extensions before publication and monitors them after release; the same Google security post also acknowledged that some bad extensions still get through.
In this case, the suspicious behavior sat close to a legitimate browser feature. That makes it harder for a normal install prompt, store listing, or short permission review to explain the privacy tradeoff. A small browser add-on can still become a high-volume data collection and advertising path once it controls search.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
