Application Security
Chrome extensions with 13.4 million installs hijacked searches for ad revenue
Researchers found 319 Chrome extensions, installed 13.4 million times, redirecting user searches for profit. Most have been removed, but new ones keep appearing.
Ross Grant2 min read
The short version
A researcher found that hundreds of Chrome browser extensions were secretly taking over users' search settings and redirecting their searches to make money from ads. These extensions had been installed over 13 million times. Most have now been removed, but new ones keep appearing. Users should check their browser for suspicious add-ons and remove them.
By the numbers
- 319Chrome extensions involved in the campaignBleepingComputer
- 13.4 millionTotal reported installs of the extensionsBleepingComputer
What happened?
Researchers found 319 Chrome extensions with a combined 13.4 million installs redirecting users' searches through tracking servers to generate advertising revenue. The extensions, pretending to offer useful features, quietly changed browser search settings. Most have been removed from the Chrome Web Store, but new ones keep appearing. Google has not commented on the findings, according to BleepingComputer.
Who is affected
According to BleepingComputer, 319 Chrome browser extensions with a combined 13.4 million installations were involved in a large-scale search hijacking campaign. These extensions were available through the Chrome Web Store, Google's official marketplace for browser add-ons. The affected extensions pretended to offer useful features like PDF conversion, safe search, or AI tools. In reality, they quietly took control of users' browser search settings. The extensions were not listed in the Chrome Web Store's search results, making them harder to find unless users followed direct links, often from questionable online ads.
How the attack worked
The extensions used a built-in Chrome feature called 'chrome_settings_overrides' to change the browser's default search engine. This allowed them to redirect every search query through servers controlled by the extension operators. From there, searches were sent on to Bing or Yahoo, but with tracking codes that generated advertising revenue for the operators. The extensions needed very little code to do this, some only included a manifest file and icons, with no extra scripts or permissions.
Researchers found that the proxy servers could change the final destination of a search at any time, without updating the extension. This means that while the extensions currently focus on making money from search referrals, they could just as easily redirect users to phishing sites or malicious downloads in the future. One example, Predator Search, sent identical search queries to four different destinations, depending on decisions made by the proxy server at the time.
The response
Most of the extensions identified in the report had been removed from the Chrome Web Store by the time the findings were published. However, the researcher warned that new, similar extensions are constantly being added. Google has not yet commented on the findings, according to BleepingComputer. Users are advised to uninstall any extensions listed in the research, run a full antivirus scan, and avoid installing browser add-ons from unknown publishers.
What you should do
If you use Chrome, check your installed extensions for any you do not recognise, especially those offering search, PDF, or security features from unknown developers. Remove any suspicious extensions. Running a full antivirus scan can help catch any further unwanted software. Be cautious about installing browser extensions, especially those promoted through ads or unfamiliar websites. Stick to well-known publishers and check reviews before installing.
Why it matters
Browser extensions can quietly take control of your searches and direct you to sites you did not intend to visit, sometimes for profit and possibly for more harmful reasons in the future. Even extensions from the official store can be risky if you do not check who made them.
Key points
- 319 Chrome extensions hijacked searches for ad revenue
- 13.4 million installs affected, according to researchers
- Extensions used Chrome's settings to redirect searches
- Most extensions have been removed, but new ones appear regularly
- Users should uninstall suspicious extensions and run antivirus scans
Sources
BleepingComputer
Reference
