Security firm Socket has identified 319 Chrome extensions, with 13.4 million reported installs over about a decade, that swap your default search engine and send every search through the operator’s own server first. The findings come from a report by researcher John Tuckner, published on October 29, 2026. If you ever clicked a popup offering a “PDF manual finder” or “safe search” tool, this is how Chrome extensions hijacking searches usually reach people. The unsettling part is how little they need: one of the extensions Socket analyzed is a settings file and three icons.
TL;DR: Socket found 319 Chrome extensions, with about 13.4 million reported installs over a decade, that make an operator’s proxy your default search and collect Yahoo or Bing referral payments. Most redirects only add partner tags, but the proxy picks each destination, so that could change. Most of the extensions are unlisted in the Chrome Web Store. Check chrome://extensions and your default search engine now.
How Chrome extensions hijacking searches actually work
These extensions rely on a built-in Chrome manifest setting, chrome_settings_overrides, that lets an extension replace your default search provider. Socket’s example, Safe Game Search, is a manifest file plus three icons, with no permissions, no background script and no interface.
Chrome does show a prompt about the search change at install, but Socket says it does not clearly state where your searches end up. They go to the operator’s proxy first, then on to Yahoo or Bing with a partner ID attached, and the operator collects a revenue share from those programs.
Because every query passes through that server, the operator sees your full search history, often tied to a unique identifier. That is why the install counts matter, and why it helps to see who is behind them.
Who is behind the 13.4 million installs
Socket traced 200 of the 319 extensions, about 5.68 million users, to identifiable operators. The largest is Intango LTD, an ad tech company that Socket says has published about 111 extensions since 2018. The other 119 extensions, about 7.76 million users, come from operators Socket could not identify.
| Cluster | Extensions | Reported users | Operator |
|---|---|---|---|
| Intango LTD | 111 | About 2.19 million | Identified by Socket |
| SecuryBrowse | 58 | About 4.9 million | Unknown |
| Bing-Search | 37 | About 2.21 million | Unknown |
| All findings | 319 | About 13.4 million | Mixed |
None of these are tools people go looking for, which is the next piece of the puzzle.
Why a hidden listing and a popup are enough
Most of the extensions are unlisted in the Chrome Web Store, so they never appear when you search the store. Socket says they are pushed through paid ads, including Google Ads and Bidbrain, often as popovers on small blogs and content farms.
The pitch is something mundane like “Search PDFs” or “Find Manuals.” A few clicks install it, and then it sits unnoticed, sending each search through a stranger’s server. Nothing breaks, so nothing prompts you to look.
That would be tolerable if the proxy always behaved, and Socket’s testing shows it does not.
What the proxy actually did in Socket’s tests
Most redirects Socket saw only added partner tags before landing on Yahoo or Bing. But the destination is chosen on the server for each request, not inside the extension. In one test of Predator Search, an extension with 50,000 users, six identical searches ended in four different places, including Yahoo with partner tags, a landing page on another domain, a two hop route and an error page.
Socket says it is only an assumption that these redirects could turn malicious. It warns that an operator could wait and later serve phishing pages or malware lures without changing the extension at all. Today’s documented cost is simpler: every query passes through someone else’s server.
What to check on your own Chrome today
BleepingComputer reports that the researcher said most of the 319 extensions had been removed from the Chrome Web Store when the report was published, and that new ones keep appearing. It also says Google had not responded to its request for comment by publication.
So 13.4 million is a total across a decade of installs, not a count of browsers affected today. Either way, checking takes about two minutes:
- Open chrome://extensions and remove any search, PDF or “safe search” tool you do not remember installing.
- Open chrome://settings/searchEngines and confirm the default is the engine you chose, deleting entries you do not recognize.
- Run a full antivirus scan, which BleepingComputer also recommends.
Google announced tighter Chrome Web Store data rules in July, with enforcement starting August 1, 2026, and Socket’s report does not say how those rules apply to these extensions. If you need screenshots of the settings page, our guide to switching your default back to Google walks through it.
