Over 300 Chrome extensions found hijacking searches of 13.4 million users — how to stay safe
A security researcher investigated more than 300 Chrome extensions that hijack searches to earn revenue.
An ongoing investigation by John Tuckner has uncovered a search hijacking campaign involving 319 Chrome extensions, downloaded 13.4 million times. The malicious extensions redirect search queries through tracking servers, generating advertising revenue for Bing and Yahoo. This is a significant increase from Tuckner's April report, which found only 57 Chrome extensions with 6 million downloads.
The extensions are often disguised as PDF converters, AI search tools, or safe search, and are typically found on shady advertising sites rather than the official Chrome Web Store. They exploit Chrome's built-in chrome_settings_override setting, replacing users' default search providers and routing queries through suspicious proxy servers.
The extensions' primary goal is to collect partner referral payments from Yahoo or Bing. While most of the extensions have been removed from the Chrome Web Store by the time of the report, new ones are continually added. To stay safe, users should be extra cautious when downloading and adding extensions to their browser, checking ratings and reviews, researching the developer's legitimacy, ensuring their Windows or Mac computer is protected with the best antivirus software, and considering one of the best identity theft protection services.
Written by urgent.news from Tom's Guide's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
