Fake PDF and search tools hijacked searches for 13.4 million Chrome users
Socket tied 319 mostly unlisted Chrome Web Store extensions, promoted by ads, to query proxying toward Yahoo or Bing.
Ads promoted extensions as manual finders, PDF converters, safe search, or AI search. Socket researcher John Tuckner identified 319 extensions with an estimated 13.4 million installs over a decade. They changed default search settings and routed queries through operator-controlled servers, often with a unique identifier, before sending them to Yahoo or Bing, exposing searches and generating referral payments. Socket found no evidence the proxies had sent users to phishing or malware pages.
Unconfirmed: The 13.4 million install figure is Socket’s estimate, and Socket reported no evidence of phishing or malware redirects.
- Most extensions were unlisted, so ordinary Chrome Web Store searches would not show them.
- Promotion included Google Ads, a landing page, and installation from the official store.
- Searches can reveal health, financial, workplace, or other personal matters.
- Users are directed to chrome://extensions, search settings, and Socket’s extension list.
Impact: Operators could read search queries tied to an identifier
| Product | Affected |
|---|---|
| Google Chrome | — |
- 1.Open chrome://extensions and remove extensions you do not recognize or trust.
- 2.Check Chrome search-engine settings for control by an extension.
- 3.Compare installed extensions with the list in Socket’s blog.
- ATT&CK
- T1176 Browser Extensions
From the original article
2 min read at malwarebytes.com
319 Chrome extensions sent search queries through servers controlled by their operators, allowing them to see what users searched for.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.