319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers

Socket researcher John Tuckner identified 319 Chrome extensions, with an estimated 13.4 million installs over a decade, that hijacked default search settings and proxied queries through operator-controlled servers before forwarding them to Yahoo or Bing. The operators could read queries, which were often tied to a unique identifier, and earned referral payments. The extensions were promoted through ads on networks including Google Ads and were listed in the official store, mostly as unlisted entries reachable only by direct link.

For IT people · Written by AI from 1 source · Wrong?