319 Chrome extensions override default search without extra permissions
Original title: 319 Suspicious Chrome Extensions Hijack Default Search Settings Without Sensitive Permissions
The decade-long set is linked to about 13.4 million reported users, a cumulative figure rather than current infections.
Investigators identified 319 suspicious Chrome extensions that replace the default search provider through chrome_settings_overrides.search_provider without requesting sensitive permissions. Queries pass through operator-controlled infrastructure before Yahoo or Bing results. The expanded investigation adds 264 extensions and another 8.7 million reported users to activity tracked since 2016. Researchers associated clusters with Intango LTD and SecuryBrowse but did not demonstrate phishing pages or malicious downloads.
Unconfirmed: Reported user totals are cumulative and do not prove current infections, data retention, or malware delivery.
- One analyzed extension contained only a manifest and three icons.
- Predator Search, listed with 50,000 users, returned varying destinations for identical queries.
- About 111 extensions and 2.2 million installs were linked to Intango LTD.
- SecuryBrowse accounted for 58 extensions and about 4.9 million reported users.
Impact: Search queries can be observed by an intermediary operator
| Product | Affected |
|---|---|
| Google Chrome extensions | — |
- 1.Inspect installed extensions, default search providers, and redirect chains.
- 2.Remove unfamiliar add-ons and restrict unauthorized extensions.
- ATT&CK
- T1176 Browser Extensions
- Vendors
- Products
- Chrome
- Organizations
- Intango LTDSocketSecuryBrowse
From the original article
2 min read at gbhackers.com
An investigation into browser extensions identified 319 suspicious extensions linked to about 13. 4 million reported users, exposing a search-hijacking ecosystem operating since 2016. Marketed as manual finders, PDF converters, safe search utilities, and AI search tools, the extensions funnel queries through operator-controlled infrastructure before delivering Yahoo or Bing results.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.