Chrome extensions caught hijacking your searches

A researcher found more than 300 Chrome extensions, with about 13.4 million users, that route searches through their creators' servers. How to check your browsers.

John Tuckner, a researcher at the security company Socket, identified 319 Chrome extensions that hijack the searches of the people who install them. Together they add up to about 13.4 million users over the past decade. They posed as useful tools: PDF converters, manual finders, safe search or AI-powered search.

How they work

The extensions change Chrome's default search engine, something the browser allows with a simple setting; some do not even contain additional code. Every search goes first through their creators' servers and then reaches Bing or Yahoo, and they collect a commission for that traffic. The bigger risk is that the intermediate server decides the destination: in one test, six identical searches ended up at four different sites. Socket notes that it has not verified that these redirects are malicious, but tomorrow it could be a fake page that steals passwords or a malware download, without the extension changing at all.

Two of the largest groups caught were "Bing-Search", with 37 extensions and 2.2 million users, and "SecuryBrowse", with 58 extensions and 4.9 million, which used security-sounding names such as Fire Shield, Securify and WatchTower. They were in the official Chrome store but hidden from its search, and were promoted through ads. Socket warns that even when extensions are taken down, new domains and lures pop up quickly.

How to check your browser

Open chrome://extensions and remove any extension you do not recognize or no longer use.
In Settings → Search engine, confirm that the search engine is the one you chose.
If an extension had changed the search engine, scan the computer with your antivirus and change the passwords you typed in that browser.
Install extensions only from known publishers and be wary of those that come through an ad.

At work: a list of allowed extensions

Chrome and Edge let you block all extensions and allow only an approved list, using Windows policies or the Google admin console. It is the most effective way to keep an employee from unknowingly installing an extension that diverts their searches or reads what they type.

October 31 update: data from Socket's report

We checked this article against Socket's original report and clarified three details: there are 319 extensions, Bing-Search and SecuryBrowse are among the largest groups but not the only ones, and Socket does not confirm that most have already been removed.

How we help you

With our IT support we review your team's browsers, remove risky extensions and set up the allowed-extensions list on every computer. Write to us to schedule the review.