319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers

Socket reports 319 Chrome extensions (about 13.4 million estimated installs) that overrode default search settings and routed queries through operator-controlled proxies before passing them to Yahoo or Bing, monetised via referrals. Queries were often linked to a unique identifier, allowing users' searches to be correlated over time. Socket notes the proxy could in principle redirect users to phishing or malware pages, but found no evidence this happened. No CVEs are cited. Defenders should review installed extensions via chrome://extensions, check Chrome's search engine settings for extension-controlled overrides, and compare extension IDs against the list published at the end of Socket's blog.

For security analysts · Written by AI from 1 source · Wrong?