319 Browser Extensions Hijack Searches, With 13.4 Million Reported Users

Socket identified 319 search-hijacking browser extensions with approximately 13.4 million reported users across a decade, including 264 newly identified extensions accounting for 8.7 million additional users. The extensions alter browser search settings, route queries through operator-controlled proxies, and monetize redirected traffic through Yahoo or Bing search-syndication programs. Many are unlisted in the Chrome Web Store and promoted through advertisements for PDF tools, manual finders, security features, and other utilities. Researchers linked groups of extensions to advertising and software businesses while documenting large unattributed clusters, including SecuryBrowse and Bing-Search.

The findings highlight a browser-management blind spot: extensions can expose search queries through search-provider overrides even without requesting permissions or including executable scripts. Researchers observed server-side redirects changing between requests, giving operators control over traffic destinations; however, redirects to phishing or malware sites remained a potential risk, not a demonstrated outcome. Security teams should inventory installed extensions and search-provider settings, remove unauthorized search overrides, and restrict extension installations to approved tools rather than relying solely on permission-based screening.