A browser extension does not need to steal your password to put your privacy at risk. Sometimes, simply changing where your searches go can expose more information than you realize.
A new cybersecurity investigation has identified 319 Google Chrome extensions associated with search hijacking, with approximately 13.4 million installations recorded over a period of nearly ten years.
The research, published by Socket on October 29, 2026, found that these extensions were promoted as tools for activities such as finding PDF documents, locating product manuals, improving searches, and accessing browser utilities. Behind these seemingly useful features, the extensions could redirect searches through servers controlled by their operators.
The findings highlight an often-overlooked security risk: browser extensions can influence how users access information, collect search activity, and create opportunities for privacy abuse without displaying obvious signs of malicious behavior.
For individuals and businesses, the incident is a reminder that browser extensions should be treated as software requiring security review, not harmless additions to a browser.
1. What Did Researchers Discover?
Socket’s investigation identified 319 extensions associated with search hijacking. The research expanded on earlier findings by identifying 264 additional extensions, bringing the estimated total number of affected installations to approximately 13.4 million.
The activity reportedly dates back to 2016 and involves several groups of publishers and operators.
Researchers found that many extensions were difficult to discover through ordinary searches in the Chrome Web Store because their listings were unlisted. Instead, users were often directed to them through online advertisements and dedicated installation pages.
Some extensions appeared to offer straightforward utilities, including PDF search tools, manual finders, and alternative search experiences.
However, the main functionality of certain extensions was to change the browser’s default search provider and route searches through intermediary infrastructure.
This matters because users may install an extension for a specific convenience without realizing that it changes how their browser handles every subsequent search.
The reported installation figure reflects activity accumulated over time. It should not be interpreted as confirmation that all 319 extensions remain active or that all 13.4 million users are currently exposed.
2. How Does Search Hijacking Work?
Search hijacking occurs when software changes or manipulates a user’s normal search experience without providing clear, meaningful disclosure of what is happening.
In the cases examined by researchers, the process involved several steps.
A. An extension changes the default search provider
A user installs an extension advertised as a helpful browser tool.
During installation, the extension changes the browser’s default search configuration. This can be implemented through Chrome’s built-in extension settings rather than through a complicated background program.
As a result, searches entered into the browser’s address bar may no longer follow the route the user expects.
B. Searches pass through an intermediary server
Instead of sending a search directly to a provider such as Yahoo or Bing, certain extensions route the request through a server controlled by the operator.
This intermediary can record search requests and determine where to send them next.
Because search queries can reveal personal interests, work-related investigations, business plans, or other sensitive subjects, this creates a privacy concern even when the final results page looks legitimate.
C. Search traffic generates referral revenue
Researchers found evidence that some operators used search syndication and affiliate tracking arrangements to generate revenue.
Search providers can compensate partners for directing traffic to their services. The extensions could append partner identifiers to redirected searches, allowing operators to receive referral payments.
This means the extensions did not necessarily need to steal credentials or install conventional malware to make money. Manipulating search traffic itself could be commercially valuable.
D. Redirect destinations can be controlled remotely
The research also found that intermediary servers could determine the destination of individual search requests.
Most observed redirects reportedly led to legitimate search results with referral tracking parameters. However, the ability to control redirects creates an additional security concern because destinations can potentially change based on the request or other conditions.
A malicious operator could potentially direct selected users toward deceptive pages, phishing websites, or harmful downloads.
This is a potential abuse scenario, not evidence that every extension was observed delivering malware or stealing credentials.
3. Why Can These Extensions Be Difficult to Detect?
One of the most concerning aspects of the investigation is that some extensions appear to offer limited functionality while operating in ways that are not immediately obvious to users.
Hidden or unlisted store pages
Some extensions were not readily discoverable through normal Chrome Web Store searches. Users often encountered them through advertisements or external installation pages.
This makes independent discovery and review more difficult.
Minimal permissions can create false confidence
An extension may not request broad permissions to read website content or access browsing history, yet still alter the default search provider through its manifest configuration.
As a result, checking only the permissions displayed during installation may not reveal the full privacy implications.
Users and administrators should also examine what an extension changes, where it sends information, and whether those behaviors are necessary for its stated purpose.
Familiar search engines can conceal the change
When a redirected search ultimately reaches a recognized provider, users may not notice the intermediary infrastructure or additional tracking parameters.
The experience can look normal even though the request has passed through an additional system controlled by another party.
New extensions can replace removed ones
Researchers identified activity spanning multiple years and different publisher identities. Extensions may be removed or become less visible while similar offerings continue to appear.
This creates a challenge for security teams that rely exclusively on a one-time review or a static list of known malicious extensions.
4. What Information Could Be Exposed?
The risks depend on how an extension and its associated infrastructure operate.
Potential concerns include:
Search history exposure: Search queries may reveal personal interests, research topics, business activities, or other sensitive information.
User profiling: Search activity may be associated with network information or other identifiers, potentially allowing operators to build profiles of users or browsing patterns.
Unwanted redirection: Operator-controlled infrastructure may direct users to destinations they did not intend to visit.
Phishing exposure: If a redirect is manipulated, a user could be sent to a deceptive website designed to collect credentials or other sensitive information.
Corporate information leakage: Employees searching for internal projects, vendors, technical issues, or business strategies could unintentionally expose information about their activities.
These are risks associated with the behavior described in the investigation. The reported findings do not establish that every affected extension collected the same information or that every user experienced each consequence.
5. Why Businesses Should Take Browser Extensions Seriously
Browser extensions often fall outside the security controls organizations apply to traditional desktop applications.
Yet browsers are used to access email, cloud platforms, financial systems, customer records, collaboration tools, and internal business applications.
An unapproved extension can introduce an additional party into that environment, creating risks that are difficult to identify if browser software is not included in an organization’s asset and application management processes.
<h5style=”color: #008000;”>Financial services
Employees may use browser-based platforms to access financial information, customer services, and internal reporting systems. Organizations should limit extensions that are not required for business operations.
Healthcare
Browser security is important wherever staff access patient portals, healthcare applications, or confidential information. Extension governance should form part of broader endpoint and data protection controls.
Retail and e-commerce
Employees may access payment-related platforms, customer support tools, inventory systems, and business dashboards through their browsers. Unnecessary extensions can introduce avoidable privacy and security risks.
Manufacturing
Engineering teams and business users may rely on browser-based supplier portals, cloud applications, and operational dashboards. Approved extension policies can help reduce exposure across these environments.
Government and regulated organizations
Public institutions and regulated businesses should evaluate browser extensions as part of software inventory, data protection, access management, and compliance processes.
The broader lesson is that endpoint security should account for the software running inside browsers, not just applications installed directly on operating systems.
6. What Should Users Do to Protect Themselves?
Users and organizations can take practical steps to reduce exposure to search hijacking.
1. Review installed Chrome extensions
Open Chrome and navigate to:
chrome://extensions
Review every installed extension. Remove those that are unfamiliar, unused, unnecessary, or inconsistent with the purpose for which they were installed.
For company-managed browsers, coordinate removals with IT teams when required by organizational policy.
2. Check your default search engine
Review Chrome’s search settings and confirm that your preferred search provider is selected.
If your search behavior changed unexpectedly, investigate recently installed extensions and other browser configuration changes.
3. Install extensions only from trusted sources
Before installing an extension, evaluate its publisher, stated purpose, update history, privacy disclosures, and requested access.
A listing in an official store should not be treated as a guarantee that the extension is safe.
4. Be cautious with advertisements promoting browser utilities
Avoid installing extensions through unexpected pop-ups or advertisements promising instant access to manuals, PDF searches, security enhancements, or other convenient tools.
Whenever possible, use the original website or a trusted application instead.
5. Review browser behavior after installation
Pay attention to unexpected search redirects, unfamiliar domains, changes to the new-tab page, or alterations to browser settings.
Unexpected behavior should prompt a review of installed extensions and browser configuration.
6. Reset settings if necessary
After removing suspicious extensions, review your default search provider and other browser settings.
If unusual behavior persists, consider Chrome’s available reset options and run appropriate endpoint security checks. In a managed business environment, involve the security or IT team before making changes that could affect company configurations.
7. Change credentials if there is evidence of broader compromise
Search hijacking alone does not establish that passwords were stolen.
However, if an investigation reveals that an extension also accessed credentials, sensitive sessions, or other account information, use a trusted device to change affected passwords, revoke active sessions where appropriate, and enable multifactor authentication.
8. Organizations should enforce extension governance
Business security teams should maintain an inventory of browser extensions, restrict installation to approved tools where practical, review publisher changes, and monitor browser configuration drift.
Regular reassessment is important because an extension’s behavior or ownership can change after its initial approval.
7. What Security Teams Should Learn From This Research
The investigation highlights several important principles for enterprise cybersecurity.
- Software trust must be continuously evaluated: An extension’s original purpose or reputation does not guarantee that its current behavior remains safe.
- Permissions are only one part of the review: Configuration changes, network destinations, data flows, and actual functionality also matter.
- Browser activity can contain sensitive information: Search queries and browsing behavior deserve appropriate privacy protections.
- Application inventories should include browser add-ons: Extensions should be managed alongside other software used in the organization.
- Security policies must be enforceable: Approved extension lists, centralized browser management, and regular audits can reduce unnecessary exposure.
- Privacy and compliance should be considered together: Organizations should assess what information is collected, why it is processed, and whether the activity aligns with applicable policies and legal obligations.
These practices can help businesses reduce the risk of unauthorized data collection, deceptive redirects, and unwanted software behavior.
Conclusion: A Small Browser Add-On Can Create a Significant Security Blind Spot
The discovery of 319 search-hijacking extensions associated with approximately 13.4 million installations demonstrates how seemingly ordinary browser utilities can create privacy and security risks at scale.
The key concern is not simply that a search engine may change. It is that users may lose visibility into how their search requests are handled, which systems receive their information, and who controls the redirection process.
For businesses, browser extensions should be included in endpoint security, software governance, and data protection strategies. For individuals, regularly reviewing extensions and avoiding untrusted installation links are simple but valuable defensive measures.
Trust should be earned through verification, not assumed because an extension looks useful or appears in an official store.
Proactive extension management can help organizations protect sensitive information, reduce unnecessary exposure, and build a stronger cybersecurity posture.
How COE Security Can Help
COE Security helps organizations strengthen their cybersecurity posture through penetration testing, application security consulting, vulnerability assessments, and customized cybersecurity services.
Our services can help identify weaknesses in web applications, assess risks involving browser-accessible systems, improve security controls, and strengthen vulnerability management practices. We also support organizations in aligning security activities with applicable compliance and governance requirements.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
Follow COE Security on LinkedIn for practical cybersecurity advice, emerging threat updates, and insights to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article