A network of 319 Chrome extensions routed users’ searches through infrastructure controlled by their operators, potentially exposing sensitive queries from an estimated 13.4 million installations over roughly a decade. The findings, reported by Socket researcher John Tuckner, concern extensions presented as PDF converters, manual finders, safe-search utilities and AI search tools. Malwarebytes reported the investigation. [1]
Rather than sending searches directly to a chosen search engine, the extensions altered Chrome’s default-search configuration and passed queries through operator-controlled proxy servers before forwarding them to Bing or Yahoo. That arrangement could generate referral revenue for the operators while giving them visibility into what users searched for. Socket said many queries were tied to a unique identifier, potentially allowing searches to be associated over time.
The campaign was distributed through advertising, including Google Ads, and used landing pages to promote an immediate utility before directing users to the Chrome Web Store. Most of the extensions were unlisted, meaning they could still be installed by anyone with a direct listing link but would not normally appear in store searches. The approach gave the extensions the appearance of a conventional Chrome installation while making discovery and review more difficult.
Search terms can disclose health concerns, financial problems, workplace interests and other personal information, making the collection risk significant even when the final results appeared on a legitimate search engine. Socket said the proxy infrastructure could theoretically redirect users to phishing or malware sites, but the investigation did not find evidence that these extensions had done so. The report describes search hijacking and tracking behavior, not a Chrome vulnerability, and no CVE, CVSS score or public exploitation record was identified in the findings.
Users who installed a search, PDF, manual-finder or security extension after clicking an advertisement should open chrome://extensions, remove anything unrecognized or untrusted, and review Chrome’s default search engine under Settings andgt; Search engine. Chrome may indicate when an extension controls a search setting, although the absence of that warning does not establish that every installed extension is safe. Organizations should also inventory browser extensions and investigate unusual search redirects or proxy traffic, while affected users should run a trusted security scan after removing suspicious software.
