319 Chrome Extensions Hijacked Searches for 13.4 Million Users

Chrome users were quietly exposed to search hijacking after 319 extensions promoted as tools for finding manuals, converting PDFs, or making searches safer were found to funnel queries through servers controlled by their operators. Socket researcher John Tuckner identified the set, estimating 13.4 million installs over a decade. The extensions redirected searches to Yahoo or Bing via the operators’ servers, enabling the operators to access users’ queries and earn referral payments.

The extensions were advertised through networks including Google Ads, and promoted features such as “manual finders,” “PDF converters,” “safe search” and “AI search.”

The extensions appeared in Google's official store, but most were unlisted, meaning only users with a direct link could visit a listing and install them; ordinary store searches would not reveal them. An advert would offer help with an immediate task, a landing page encouraged installation, and the official store provided a familiar completion point.

The main risk was the potential visibility of users’ search terms, which could reveal sensitive information such as health concerns, finances, or work matters; queries were often linked to a unique identifier, allowing a user’s searches to be traceable over time. While Socket notes the proxy could direct users to phishing or malware pages, it did not find evidence that the extensions had actually done so.