Google Ads

319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers

Socket◼ researcher John Tuckner identified 319 Chrome◆ extensions, with an estimated 13.4 million installs over a decade, that hijacked default search settings and proxied queries through operator-controlled servers before forwarding them to Yahoo or Bing. The operators could read queries, which were often tied to a unique identifier, and earned referral payments. The extensions were promoted through ads on networks including Google Ads◆ and were listed in the official store, mostly as unlisted entries reachable only by direct link.