Ads promoted browser extensions as tools to find manuals, convert PDFs, or make searches safer. But many of these extensions sent users’ search queries through servers controlled by their operators.
Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. The extensions hijacked users’ default search settings and routed their searches through servers controlled by the operators before sending them to Yahoo or Bing. This gave the operators access to users’ queries and let them earn referral payments.
Socket says the extensions were promoted through ads on networks including Google Ads, promoting tools such as “manual finders,” “PDF converters,” “safe search,” and “AI search.”
The extensions were listed in Google’s official store, but most were unlisted. That means people with a direct link could visit a listing and install an extension, while ordinary searches in the store would not show it. An ad offered help with an immediate task, a landing page encouraged installation, and the official store provided a familiar place to complete it.
Search hijacking
The main risk was that operators could see what users searched for. Searches can reveal health worries, financial problems, workplace interests, or other personal matters. Socket says queries were often associated with a unique identifier, which could let the operators link a user’s searches over time.
The proxy could also choose where to send a search. Socket says this could potentially direct users to phishing or malware pages, but it did not find evidence that the extensions had done so.
What should users do?
If your searches start going astray, or you installed a search, PDF-converter, manual-finder, or security extension after clicking an ad, check what’s installed.
- Review your extensions. Enter
chrome://extensions in Chrome’s address bar. Remove extensions you don’t recognize, no longer use, or don’t trust. To remove one, select Remove and confirm. If you’re unsure about an extension, check it against the list at the end of Socket’s blog.
- Check your search settings. In Chrome, at the top right, select More (the three-dot menu), then Settings > Search engine. If Chrome says an extension is controlling a setting, review or remove that extension. The absence of this notice doesn’t confirm that all your extensions are safe.
- Run a Malwarebytes scan to check for malicious extensions and other malware that could be affecting your device.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Source: Malwarebytes Labs · 2026-10-30
