Chrome extensions hijacking searches: what to check now

Security researchers at a firm called Socket have identified 319 Chrome extensions, with a combined 13.4 million reported installations, that quietly redirect people's searches. The extensions pose as PDF converters, manual finders, safe search tools and AI search assistants. Instead of doing what they claim, most of them route your search through a chain of tracking sites before dumping you on Bing or Yahoo, earning the people behind them advertising revenue along the way.

This builds on an earlier report from April 2025, which found 57 similar extensions with 6 million users. The new report adds 264 more. Some were hosted directly on the official Chrome Web Store, but kept unlisted so they don't turn up in the store's own search. Instead they were pushed through adverts on other websites. One analysed example needed almost no code at all: just a manifest file and some icons, exploiting a built-in Chrome setting that lets an extension quietly swap your default search provider.

What this actually means for you

If you have ever installed a browser extension that promised to find printer manuals, convert files to PDF, add "safe search", or boost your search results with AI, it is worth ten minutes to check it. The researcher behind the report found that one example extension, when tested with six identical searches, sent the results to four different destinations, including partner pages and, on one occasion, a Cloudflare error page. That inconsistency is the point. The extension doesn't need to do anything malicious today to be a problem tomorrow. The company behind it can change where your searches go at any time, without you updating or reinstalling anything.

This is not, as far as the report shows, about stolen passwords or financial details. It is about your searches being rerouted for ad money, and about the uncomfortable fact that the same mechanism could, in future, be pointed somewhere worse, such as a phishing page or a fake download.

What to do

• Open Chrome's extensions page (type chrome://extensions into the address bar) and look at everything installed, not just the ones you use often.
• Be suspicious of anything calling itself a PDF converter, manual finder, safe search tool, or AI search add-on, especially if you don't remember installing it deliberately or don't recognise the publisher.
• Remove anything you don't actively need. Extensions you installed once and forgot about are the easiest way for this kind of thing to sit unnoticed for months.
• After removing anything suspicious, run a full scan with your antivirus software.
• Check your browser's default search engine setting. If it has changed to something you don't recognise, change it back.
• In future, install extensions by searching for them directly in the Chrome Web Store rather than clicking adverts on other websites promising a tool you need right now. Stick to well-known publishers and glance at what permissions an extension asks for before you install it.

Most of the specific extensions named in Socket's report had already been removed from the Chrome Web Store by the time it was published. That's reassuring up to a point, but the researchers note that new versions of the same scheme keep appearing, often under different names. Checking what's currently installed matters more than checking a list of names that may already be out of date.

What this does not fix

A VPN does not stop a malicious browser extension from rerouting your searches. The extension sits inside your browser, between you and the page you're trying to reach, and a VPN only changes how your connection reaches the internet, not what your browser does once it gets there. The fix here is removing the extension itself, not changing your network connection.

It's also worth being honest about what is and isn't known. Google had not responded to questions about these findings at the time the report was published, so there's no confirmation yet of what action, if any, the Chrome Web Store will take against this pattern more broadly. And while the researcher warns that redirect destinations could turn malicious, that hasn't been confirmed to have happened. The sensible response is to remove the risk now, not to wait and see what it turns into.