Socket identifies search hijacking in 319 Chrome extensions

Socket researcher John Tuckner identified 319 Chrome extensions that redirect searches through tracking servers before sending users to Bing or Yahoo, BleepingComputer said on October 29, 2026. The add-ons have 13.4 million reported installations—a total of installations, not verified victims or people currently affected.

The investigation expands Tuckner’s April 2025 discovery of 57 Chrome extensions. The newly described activity centres on taking over the browser’s default search provider and earning payments for sending searches to Bing or Yahoo.

How the extensions redirect searches

Tuckner said Chrome’s built-in chrome_settings_overrides setting lets an extension replace the default search provider. Searches then pass through a proxy—an intermediary server controlled by the operator—before reaching the search service. Operators use partner identifiers to collect referral payments for that traffic.

Socket says the extensions are presented as PDF converters, manual finders, safe-search tools or superintelligence (SI) search tools. Their Chrome Web Store listings are unlisted, meaning they do not appear in store searches; website advertisements promote them instead.

Socket identified groups including Bing-Search and SecuryBrowse. The latter includes security-themed extensions named Fire Shield, Securify and WatchTower.

Tuckner says destinations can change without an update

Tuckner tested Predator Search with six identical searches and reached four different destinations: Yahoo with referral tags, a separate landing page, a route through two other domains before Yahoo, and an error page. The extension stayed unchanged while the proxy selected each destination.

The observed activity focused on tracking searches and generating referral revenue. Tuckner warned that operators could later redirect users to phishing pages, which try to trick people into revealing sensitive information, or to malicious downloads. He described those as possible future risks.

Check installed extensions and remove matches

Tuckner said most identified extensions had been removed from the Chrome Web Store by publication, but new ones continued to be added. Google had not responded to the outlet’s request for comment by publication.

BleepingComputer recommends checking installed add-ons against the full list at the bottom of Socket’s report and uninstalling any listed extensions from the browser. It also recommends running a full antivirus scan and avoiding unnecessary tools or browser add-ons from unknown publishers.