Malware · · 3 min read
Hidden Chrome extensions quietly rerouted searches for about 13.4 million users
Researchers at Socket found 319 Chrome extensions that take over your default search engine and pass every query through their own servers first. How to check yours.
Browser extensions that promise a PDF converter, a manual finder, “safe search” or AI search have been quietly taking over people’s search engine. A new report says 319 of them, with about 13.4 million installs between them, send every search through servers their operators control before passing it on. Most have now been removed, but new ones keep appearing. Here’s what they do and how to check your browser in a couple of minutes.
What happened
On October 29, 2026, John Tuckner of the security company Socket published Searchjacked, which adds 264 newly found extensions, used by about 8.7 million people, to research he first published in 2025. Socket says the extensions were made by a handful of organized operators and that the technique has been running for about a decade.
The extensions replace your browser’s default search engine. Your searches go to the operator’s server first and then on to Yahoo or Bing with a partner code attached, so the operator earns a share of the ad revenue. Many of them are unlisted in the Chrome Web Store, so you won’t find them by searching the store. Instead they’re pushed through ads on other websites. Some contain almost no code at all: a single built-in setting is enough to change the default search engine.
Socket points out two risks beyond the ad money. Because every search passes through the operator’s server, the operator can see your full search history, often tied to a unique ID. And because the server decides where each search ends up, it could send some searches to a phishing page, a fake results page or a malicious download without any update to the extension. In one test reported by BleepingComputer, six identical searches through one extension ended up in four different places.
BleepingComputer says most of the extensions had been removed from the Chrome Web Store by the time the report came out. Socket’s report lists them all.
What this means for you
Your searches say a lot about you: health questions, money worries, places you plan to go. An extension that collects them doesn’t need any special permission to do it, which is why these are easy to miss.
What you can do
- Check your default search engine. In Chrome, open Settings, then Search engine. If it isn’t the one you chose, something changed it.
- Review your extensions. Open
chrome://extensionsand remove anything you don’t recognize or no longer use, especially search, PDF, manual or “safe browsing” tools you installed from an ad. - Compare against Socket’s list. The full list of extensions is at the end of Socket’s report.
- Install extensions on purpose. Get them from the store page of a developer you know, not from a pop-up or an ad that says you need one.
- Change any password you typed into a strange page. If a search ever landed you on a sign-in page that looked off and you entered details, change that password and turn on two-factor sign-in.
How Frame helps
This one is about your browser, so the steps above matter more than any app. If you think a fake page caught a password, Frame’s guide to locking down your Google and Apple accounts walks through checking sessions and turning on stronger sign-in. Frame’s email aliases also give each site its own address, so a phishing message sent to the wrong address is easier to spot.
Sources
- Socket, Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users, October 29, 2026
- BleepingComputer, Chrome extensions with 13.4 million installs caught hijacking searches, October 29, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.