319 Chrome extensions with 13.4M installs hijacked default search and proxied queries via operator servers
Socket researcher John Tuckner identified 319 Chrome extensions with an estimated 13.4 million installs over a decade that hijacked users' default search settings. Searches were routed through operator-controlled servers before reaching Yahoo or Bing, giving operators visibility into queries and referral revenue. The extensions were promoted through ads (including Google Ads) as "manual finders," "PDF converters," "safe search," and "AI search" tools.
Detalhes técnicos
- Extensions were hosted on the official Chrome Web Store, but most were unlisted, installable only via direct link from ad landing pages.
- Queries were often tied to a unique identifier, allowing operators to link a user's searches over time and potentially expose health, financial, or workplace interests.
- The proxy could redirect searches to phishing or malware pages, but Socket found no evidence this occurred.
Remediação
- Open chrome://extensions and remove unrecognized, unused, or untrusted extensions; compare against the list at the end of Socket's blog.
- Check Settings > Search engine for an extension controlling the setting; note that its absence does not prove all extensions are safe.
- Run a malware scan (Malwarebytes recommended in the article).
Linha do tempo
-
319 Chrome extensions with 13.4M installs hijacked default search and proxied queries via operator servers
ler a análise desta fonte ocultar
Socket researcher John Tuckner identified 319 Chrome extensions with an estimated 13.4 million installs over a decade that hijacked users' default search settings. Searches were routed through operator-controlled servers before reaching Yahoo or Bing, giving operators visibility into queries and referral revenue. The extensions were promoted through ads (including Google Ads) as "manual finders," "PDF converters," "safe search," and "AI search" tools.
Technical Details
- Extensions were hosted on the official Chrome Web Store, but most were unlisted, installable only via direct link from ad landing pages.
- Queries were often tied to a unique identifier, allowing operators to link a user's searches over time and potentially expose health, financial, or workplace interests.
- The proxy could redirect searches to phishing or malware pages, but Socket found no evidence this occurred.
Remediation
- Open chrome://extensions and remove unrecognized, unused, or untrusted extensions; compare against the list at the end of Socket's blog.
- Check Settings > Search engine for an extension controlling the setting; note that its absence does not prove all extensions are safe.
- Run a malware scan (Malwarebytes recommended in the article).