Over 300 Chrome Extensions Hijack Searches of 13.4 Million Users

A significant number of Chrome extensions, totaling over 300, have been found hijacking the search queries of 13.4 million users, according to reports. This search-hijacking campaign has been orchestrated to direct users to Bing and Yahoo, generating advertising revenue for the creators of these extensions ¹².

The extensions in question have managed to alter the default search engines of their users through Chrome's 'chrome_settings_override' setting, effectively redirecting all search traffic to Bing and Yahoo. This manipulation is particularly concerning because it means that even if a user types 'Google' into their address bar, they might be taken to Bing or Yahoo instead ¹².

John Tuckner of Socket made the initial discovery in October 2026, building upon his earlier findings from April 2025 where he identified 57 such extensions. This time, however, the scope of the issue was much larger, with two main clusters emerging: the 'Bing-Search' cluster, which comprised 37 extensions and affected 2.2 million users, and the 'SecuryBrowse' cluster, consisting of 58 extensions and impacting 4.9 million users ².

These extensions were created by a small group of organized operators who aimed to maximize their advertising revenue by directing users to Bing and Yahoo. However, there is a potential risk that these extensions could also redirect users to phishing sites or download malicious software, posing a threat to user safety ².

Following the publication of the report, most of the extensions have been removed from the Chrome Web Store, though they were initially unlisted and promoted through dubious online advertisements ¹². The minimal coding required for these extensions to function, thanks to Chrome's 'chrome_settings_overrides' feature, made them easy to create and deploy ².

Google stands to benefit from this situation, as the presence of numerous extensions in its marketplace increases the volume of advertisements shown to users ¹. For individuals looking to protect themselves, the advice is to carefully examine the ratings, reviews, and developer backgrounds before downloading any new extensions ¹.

What we know

• Over 300 Chrome extensions are involved in a search-hijacking campaign ¹²
• These extensions have a total of 13.4 million downloads ¹²
• The extensions redirect search queries to Bing and Yahoo to generate advertising revenue ¹²
• The extensions use Chrome's 'chrome_settings_override' setting to change the default search engine ¹²
• Most of the extensions have been removed from the Chrome Web Store after the report was published ¹²
• The extensions were discovered by John Tuckner of Socket in October 2026, expanding on his earlier April 2025 finding of 57 extensions ²
• The extensions were created by a few organized operators who aimed to redirect users' searches to Bing or Yahoo to earn advertising revenue ²
• The extensions could potentially redirect users to phishing sites or malicious downloads instead of Bing or Yahoo ²
• The 'Bing-Search' cluster included 37 extensions and 2.2 million users, while the 'SecuryBrowse' cluster had 58 extensions and 4.9 million users ²
• Google benefits from more advertisements and extensions in its marketplace ¹
• Users should check ratings, reviews, and legitimacy of developers when downloading extensions ¹
• The extensions were unlisted on the Chrome Web Store and promoted via shady online advertisements ²
• Many extensions required minimal code to function due to Chrome's 'chrome_settings_overrides' feature ²