VULNpocalypse
MediumEcosystem changeOngoing

Searchjacking: 319 Chrome extensions hijacked default search for 13.4 million users

Socket found 319 Chrome extensions, mostly unlisted, that set the default search engine and proxy queries for Yahoo and Bing referral payments.

Published
Updated
Exploitation
Yes, Socket documented the extensions capturing queries through operator proxies and collecting Yahoo and Bing referral payments; no confirmed phishing or malware redirects were found

What happened

Socket researcher John Tuckner reported 319 distinct browser extensions, installed by roughly 13.4 million users over a decade, that hijack the default search engine and route queries through operator-controlled proxy servers. The operators then send users on to Yahoo or Bing and collect partner referral payments (Socket). The research adds 264 newly identified extensions affecting 8.7 million more users to earlier work. The extensions date back to 2016 (Socket). Malwarebytes summarized the findings a day later (Malwarebytes).

How the technique works, per Socket:

  • No code needed. Many of the extensions are only a manifest that uses the built-in search provider override (chrome_settings_overrides). They request no permissions and have no background worker, content scripts or UI. Chrome shows a prompt on install, but it does not clearly say where searches end up (Socket).
  • Monetization. Operators use Yahoo’s hspart and hsimp parameters and Bing’s PC and PTAG partner tags to earn a revenue share (Socket).
  • Proxy in the middle. Queries pass through the operator’s server first, so the operator sees the full search history, often tied to a unique identifier. Redirects are decided per request. Socket saw most proxies only append partner tags, but also a repeated search sent to Google’s homepage without tags while other searches still went to Bing (Socket).
  • Variable destinations. Six identical searches through the proxy of Predator Search (odkcfoohjiicbelloepgcomekdknchjh, 50,000 users) ended in four different places, including a landing page, a multi-hop redirect chain and an error page (Socket).
  • Distribution. A majority of the extensions are unlisted in the Chrome Web Store, so store search will not show them. They are pushed through paid ads (Google Ads, Bidbrain and others), often as pop-overs or pop-unders on low-quality sites (Socket). Malwarebytes confirms most were unlisted and reachable by direct link (Malwarebytes).

Socket says the proxy could in theory serve phishing pages, fake results or malware lures, but calls that an assumption. Malwarebytes reports Socket found no evidence the extensions actually did so (Socket, Malwarebytes). Socket also notes that new domains and lures appear quickly after takedowns (Socket).

No CVE is associated with this campaign, and no fixed version exists. Whether Google has removed all listed extensions is not confirmed.

Am I affected?

You may be affected if any of these apply:

  • You installed a “manual finder”, “PDF converter”, “safe search” or “AI search” extension, especially after clicking an ad (Malwarebytes).
  • Your searches start going astray, or Chrome’s Settings > Search engine page says an extension is controlling the setting. The absence of that notice does not prove your extensions are safe (Malwarebytes).
  • An extension in your fleet sets a default search provider pointing at an unfamiliar domain. Socket’s example used a search URL on its own domain with a {searchTerms} placeholder (Socket).

The full list of 319 extensions is at the end of Socket’s post, which is the reference for matching extension IDs. That list was not included in the text reviewed for this advisory, so the IDs are not reproduced here.

What to do now

  1. Open chrome://extensions and remove extensions you do not recognize, no longer use, or do not trust (Malwarebytes).
  2. Check any uncertain extension against the list at the end of Socket’s blog (Socket).
  3. In Chrome, open the three-dot menu, then Settings > Search engine. If an extension controls the setting, review or remove it (Malwarebytes).
  4. Do not treat a “no permissions” extension as harmless. A search override alone routes every query through a third party (Socket).
  5. Run a security scan for malicious extensions and other malware, as Malwarebytes suggests (Malwarebytes).
  6. For managed fleets, audit installed extensions for search provider overrides and unlisted store items. This is a suggested step derived from the research, not a vendor recommendation.
  7. Treat searches made while an affected extension was installed as exposed to the operator, since queries were often tied to a unique identifier (Socket).

Sources