319 Chrome extensions with 13.4 million installs hijack searches; 264 newly found by Socket
Socket found 264 more Chrome extensions that redirect searches through the operators' servers, bringing the total to 319 and about 13.4 million installs. Check your extensions list and default search engine, and remove anything you didn't choose.
Open chrome://extensions and remove any extension you don't recognise or didn't choose, especially PDF, "safe search" or search tools. Then check Settings > Search engine and reset it to your preferred one. Run a security scan if unsure.
What’s happening
Researchers at Socket have identified 264 more Chrome extensions that quietly change the browser's default search engine. Combined with an earlier finding of 57 extensions, the campaign covers 319 extensions and about 13.4 million reported installs, with some tracked back to 2016. Searches pass through servers run by the operators before reaching Bing or Yahoo. The operators log the queries and collect referral payments. Socket warns that because the operator's server decides where each search ends up, it could later send people to phishing pages, fake results or malware without any change to the extension. BleepingComputer gave an example in which the same search was sent to four different destinations. The extensions pose as PDF converters, manual finders, safe-search and AI search tools, and are promoted through ads and pop-ups. Many are unlisted in the Chrome Web Store, so store search does not show them. Socket attributes about 200 to named companies and 119 to unknown operators. BleepingComputer says most had been removed from the store by publication, but new ones keep appearing. Google had not commented, and no fix is a software update.
- What
- Poisoned software
- Affects
- Google Chrome extensions (search-hijacking add-ons)
- Affected
- 319 Chrome Web Store extensions that change the default search provider, about 13.4 million installs (264 newly identified, about 8.7 million users)
- Fixed in
- No fix yet
- Since
- 29 Oct 2026
Timeline
- UpdatePartly fixed
BleepingComputer reported that most of the extensions had already been removed from the Chrome Web Store when Socket published, but that new ones keep appearing. Google had not responded to its request for comment at publication.
- Made public
Socket researcher John Tuckner published findings on 264 newly identified Chrome extensions (about 8.7 million users) that swap the browser's default search engine and route searches through operator-run servers. With earlier findings, the total reaches 319 extensions and about 13.4 million installs.
Sources
- Searchjacked: hundreds of Chrome extensions hijack searchSocket · 29 Oct 2026
- Chrome extensions with 13.4 million installs caught hijacking searchesBleepingComputer · 29 Oct 2026