319 Chrome extensions hijack searches for ad revenue
Researchers found over 300 Chrome extensions that quietly swap users’ default search engine and route queries through their own servers to earn referral payments from Bing and Yahoo.
30 Oct 2026 0 reads Compiled with AI
Security researchers from Socket have identified 319 Chrome extensions that together have 13.4 million reported installations. The analysis builds on an earlier 2025 study that found 57 extensions with 6 million users, and adds 264 newly identified add-ons with another 8.7 million users.
How the hijack works
The extensions need almost no code. They rely on Chrome’s chrome_settings_overrides setting, which lets an add-on replace the default search provider. One example contains only a manifest file and icons, with no background scripts, content scripts or requested permissions.
The add-ons disguise themselves as helpful tools such as PDF converters, manual finders, safe-search helpers or AI search aids. Most are not listed in the Chrome Web Store and reach users through spammy pop-up ads on smaller websites.
The main goal is ad revenue, but the same setup could be turned against users. Each search passes through an operator-controlled server, which lets the operators see the search history linked to a unique identifier. In a test with the Predator Search extension, six identical searches were routed to four different destinations: Yahoo, a search-related site, a second search domain and a Cloudflare error page. The extension itself never changed.
Users should uninstall any extensions they do not recognise, especially those claiming to be search, safe-search or PDF tools, and check that Chrome’s default search engine is the one they chose. Running a full antivirus scan is also advised. Google has not yet responded to the findings.