Over 300 Chrome Extensions Were Quietly Hijacking Searches

A security researcher at Socket, John Tuckner, has identified 319 Chrome extensions that quietly hijacked users' search settings. Many were promoted through ads, including on Google Ads, as PDF converters, manual finders, 'safe search' tools, or 'AI search' tools. Between them, the extensions are estimated to have been installed 13.4 million times over roughly a decade.

Instead of simply doing what they advertised, the extensions changed the browser's default search engine so that queries were routed through servers controlled by the extensions' operators, before being passed on to Yahoo or Bing. This meant the operators could see what people were searching for, and in some cases attach a unique identifier to those searches, which could allow them to be linked together over time rather than treated as one-off, anonymous queries.

Some of the extensions were listed in Google's official Chrome store, but most were unlisted. That means they could not be found by searching the store directly. They were only reachable through a direct link, typically the one in the ad that promoted them.

What this actually means for you

This is not about stolen passwords or drained bank accounts. Socket found no evidence that these extensions delivered phishing pages or malware, even though the technical setup meant they could have redirected users to one. The actual harm is quieter than that: your search history passing through a server you did not choose and cannot see.

Searches reveal more about a person than most people realise. A health worry typed into a search box, a question about debt, a search related to a job or a relationship, these are ordinary things people search for, and ordinary things most people would rather not hand to a stranger running an ad-funded extension. That is what was at stake here, not credentials or money.

It is not known how many of the 13.4 million installs were in the UK, or whether this is still happening at the time you are reading this. The extensions were promoted over roughly ten years, so some installs may be old, forgotten, or already uninstalled. The sensible response is the same either way: check what is actually running in your browser right now.

What to do

• Open your extension list. Go to chrome://extensions in Chrome and look at everything installed. Most people have more than they remember.
• Remove anything you don't recognise, don't use, or don't trust. Pay particular attention to PDF converters, manual finders, 'safe search' or 'AI search' tools, especially if you installed them after clicking an ad rather than searching for them deliberately.
• Check who controls your search engine. Go to Chrome's Settings, then Search engine, and see what is set as default. If an extension is controlling this and you don't recognise it, remove the extension and reset the setting yourself.
• If you're unsure, check the list. Socket's original research includes a list of the affected extension names. If something you have installed looks familiar, it is worth checking against that list before deciding whether to keep it.
• Run a scan. A malware or antivirus scan can help confirm whether anything malicious is sitting on your device beyond the browser extension itself.
• Be more wary of extensions found through ads. An extension appearing in the official Chrome store is not the same as it being vetted for what it actually does once installed. Being listed is not the same as being checked.

What this does not fix

A VPN does not see inside your browser and cannot remove a malicious extension for you. It encrypts your connection to the internet, which is a different layer entirely from what an extension does once it is sitting inside Chrome with permission to read your activity there. If an extension is hijacking your searches, a VPN will not notice and will not stop it.

There is also no evidence here that passwords or payment details were taken, so this is not a reason to panic about your bank accounts specifically. The concern is narrower and, in its own way, more ordinary: a browser tool doing something other than what it claimed, and nobody checking until a researcher happened to look. Checking your own extensions takes a few minutes. It is worth doing even if nothing looks wrong.