A researcher found 319 Chrome add-ons that take over web searches. Here is how the trick works and how to check your own browser today.
A large group of Chrome browser add-ons has been quietly taking over people's web searches. A security researcher found 319 of them, with 13.4 million reported installs, according to BleepingComputer. Check your browser's add-ons today, remove any you do not know or need, and make sure your search engine is the one you picked.
What happened
An extension, also called an add-on, is a small tool you add to your web browser. It can add features, like turning a file into a PDF. John Tuckner, a researcher at the security company Socket, published a new report about extensions for Google Chrome.
He first found 57 of these extensions, with 6 million users, in April 2025. His new report adds 264 more, with another 8.7 million users. In total, that is 319 extensions and 13.4 million reported installs.
He said the extensions were made by a small number of organized operators. They all followed the same plan.
How the trick works
The extensions look like useful tools. They pretend to be:
- PDF converters
- Tools that find product manuals
- Safe search tools
- AI search tools
After you install one, it changes your browser's default search engine. That is the site Chrome uses when you type a search into the address bar. Now your searches go through a server the operators control. A server is a computer that handles requests over the internet. Your search passes through a series of sites before it lands on Bing or Yahoo.
Along the way, the operators collect referral payments. A referral payment is money paid for sending users to a search site.
The extensions need very little code to do this. Chrome has a built-in setting that lets an extension replace the default search provider. One extension in the report had only a basic setup file and icons. It asked for no special permissions at all. So the usual warning signs may not show up.
Why it matters even if searches still work
Today, these searches often end on Bing or Yahoo. But Tuckner warns that the end point can change at any time. The operators do not need to update the extension to do it. They could send people to phishing sites, which are fake pages built to steal passwords. They could also send people to harmful downloads.
He tested one extension, called Predator Search. He ran the same search six times. The searches ended up in four different places. "The extension never changed; the proxy chose each destination as the search came in," he said.
Chrome safety is in the news in another way, too. The Hacker News reported that an unreleased research model from Anthropic found a serious flaw in Google Chrome. Google has fixed it. This is one more reason to keep Chrome up to date.
Who is at risk
Anyone who uses Chrome and has added extensions could be at risk. These extensions were hosted on the Chrome Web Store, which is Google's official place for Chrome add-ons. But they were unlisted. That means they did not show up when people searched the store. Instead, people found them through ads on other websites.
Two large groups stand out in the report:
- Bing-Search: 37 extensions with 2.2 million users.
- SecuryBrowse: 58 extensions with 4.9 million users. These were security-themed tools with names like Fire Shield, Securify and WatchTower.
Most of the extensions had been removed from the store when the report came out. Still, new ones are added all the time. If you installed one earlier, it may still be on your computer. BleepingComputer said it asked Google for comment.
What to do now
These steps take only a few minutes:
- Open Chrome's menu and go to the Extensions page. Look at every add-on listed.
- Remove any extension you do not recognize, do not use, or added after clicking a website ad. Socket's report has the full list of names, as BleepingComputer notes.
- Open Chrome's settings and see which search engine is set as the default. Change it back to the one you want.
- Run a full scan with your antivirus program. Antivirus is software that looks for harmful programs.
- From now on, only add tools you really need, from publishers you know.
If you think you were affected
First, remove the extension and reset your default search engine. Then run a full antivirus scan. Think back on any odd search results you clicked. If you typed a password into a page that looked strange, change that password on the real site. Pick a new password you have not used anywhere else.
For a small business, ask each person to check the browsers on work computers. One unwanted add-on on one machine is easy to miss.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Chrome extensions with 13.4 million installs caught hijacking searches, BleepingComputer, 2026-10-29
- Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities, The Hacker News, 2026-10-29
Tags
Frequently Asked Questions
How many Chrome extensions were involved?
The researcher found 319 extensions with a combined 13.4 million reported installs. This includes 57 he found in April 2025 and 264 new ones.
What do these extensions pretend to be?
They pretend to be PDF converters, manual finders, safe search tools and AI search tools. Some security-themed ones had names like Fire Shield, Securify and WatchTower.
If my searches still end on Bing or Yahoo, am I safe?
Not fully. The researcher warns the operators can change where searches go at any time, without updating the extension. That could include phishing sites or harmful downloads.
Were these extensions in the official Chrome Web Store?
Yes, but they were unlisted and did not show up in store searches. People found them through ads on other websites. Most had been removed when the report came out, but new ones keep appearing.
What should I do if I have one installed?
Uninstall it and run a full antivirus scan. Also avoid adding tools and add-ons from publishers you do not know.
Enjoyed this article?
Share it with your network
