319 Chrome Extensions Hijacked Searches of 13.4 Million Users, Researchers Say
Summary
Socket identified 319 Chrome extensions with an estimated 13.4 million installs that routed users’ searches through operator-controlled servers, exposing queries and generating referral payments. Researchers found no evidence the extensions redirected users to phishing-
Key points
- Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade.
- The extensions changed users’ default search settings and routed queries through operator-controlled servers before sending them to Yahoo or Bing.
- Operators could access users’ queries and earn referral payments; queries were often linked to a unique identifier.
- Extensions were advertised as PDF converters, manual finders, safe-search tools, and AI search tools. Most were unlisted in Google’s official store but could be installed through direct links.
- The proxy could potentially redirect searches to phishing or malware pages, but Socket found no evidence that the extensions did so.
- Users are advised to review and remove untrusted extensions and check Chrome’s search-engine settings.
Article Details
- Event Type
- Browser-extension search hijacking and user-query collection
- Impact
- Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions changed users’ default search settings and routed queries through operator-controlled servers before forwarding them to Yahoo or Bing, allowing operators to access searches and earn referral payments. Socket said queries were often associated with unique identifiers, potentially enabling searches to be linked over time. The proxy could potentially redirect users to phishing or malware pages, but Socket found no evidence that the extensions had done so.