Chrome search hijacking extensions reach 13.4 million installs

According to researchers, more than 13 million users have installed Chrome extensions that secretly hijack search queries to collect referral payments from Bing and Yahoo. Unlisted on the Chrome Web Store, these add-ons are mainly spread via deceptive advertisements for PDF converters and other tools.

Security researchers at Socket reported 319 Chrome extensions, released by a “handful of organized operators”, which accumulated 13.4 million installations over a ten-year period.

Most are hidden in the Chrome Web Store, so users can’t find them directly. Many are also almost empty, require no permissions, contain no background code or even an interface, and offer no useful functionality. They are designed to do one thing.

“(They) quietly take control of the browser’s default search engine, route each request through a suspicious proxy server, and collect referral payments from Yahoo or Bing partners under a syndication partner ID,” Socket said in a new report.

Hijacked searches aren’t the only risk: extensions can quickly become malicious, researchers warn. Operators control where each request ends up and can redirect users to phishing sites or malware lures based on search terms or geographic location.

The extensions manifest file simply overrides the default search engine: it’s not even code that runs, but a built-in functionality of the framework.

“Changing the default search engine will prompt the user during installation, but it will not make it clear where your searches end up,” the researchers explained.

Searches don’t go directly to Bing or Yahoo, but rather through the carriers’ proxy servers, which track queries before redirecting users.

The researchers speculate that proxy servers allow operators to measure whether their compensation matches benchmarks. Additionally, each query can potentially be monetized as trending or sentiment data.

A third potential motivation concerns “programmable redirects,” allowing operators to route traffic selectively.

Socket researchers observed cases where repeat searches were redirected to Google’s home page without a partner tag, while other searches were directed to Bing. In another case, six identical searches sent through an extension’s proxy reached four different destinations.

“This means that redirects are chosen per request based on the search itself,” the report explains.

“Search SEO revenue provides a profitable watering hole while the proxy operator can wait for data to accumulate and targets to appear before redirecting to malicious search results or landing pages for phishing or other malicious downloads.”

The researchers did not observe malicious redirects and described this scenario as a hypothesis.

The Chrome Web Store allows publishers to keep extensions unlisted so they don’t appear in search results. Operators use this to avoid public scrutiny while maintaining a facade of legitimacy.

Unlisted extensions remain accessible via a direct link and appear as harmless utility tools on their showcase pages.

“Searchjacking” extensions reach users through ad networks in the form of pop-over and pop-under ads promoting “manual searches”, “safe search”, “PDF converters”, “AI search” and other utilities.

“It only takes a few clicks for the extension to be installed and quickly forgotten,” the researchers said.

Socket assigned 200 extensions, with approximately 5.7 million users, to identifiable operators, while the remaining 119 extensions, with 7.8 million users, were released by unknown operators.

Researchers say this activity has continued continuously since at least 2016.

The largest cluster identified, “SecuryBrowse,” has 58 extensions and 4.9 million users. Another group, “Bing-Search,” includes 37 extensions distributed through Bidbrain ads.

“The Chrome Web Store hasn’t kept pace. Even if extensions are removed, new domains and lures appear quickly afterward.”

The report includes a downloadable list of affected extensions, including their IDs and release dates.

Cybernews has contacted Google for comment and will update the story with its response.