Hundreds of Chrome extensions were caught hijacking searches. Here's how to check yours

Published Oct 30, 2026, 11:08 AM EDT Viraj Gawde is a Tech Journalist with bylines at Travel+Leisure India & South Asia, Android Headlines, 91Mobiles, Croma Unboxed, etc. He has written thousands of news pieces, how-to guides, product comparisons, listicles, and op-eds on consumer tech. Currently, Viraj is obsessed with the fast-evolving world of artificial intelligence and how it is reshaping the way we work, create, and use tech. As a curious generalist, Viraj's work extends into a wide range of subjects, formats, and storytelling styles. When away from desk, he is a finance, sports, and travel geek with a constant curiosity for new experiences. Sign in to your How-To Geek account Installing a Chrome extension might feel seemingly harmless, but it could give someone else a peek at everything you search for online. You might be taking a detour you never signed up for. That’s what security researchers at Socket have uncovered — 319 Chrome extensions with a collective 13.4 million installations that push people’s searches through hidden servers before landing on Bing or Yahoo. Nothing looks alarming, which is why they stay under the radar. 319 Chrome extensions turn searches into paychecks The trick needs no code Credit: Lucas Gouveia / How-To Geek Socket researcher John Tuckner first discovered 57 similar extensions with 6 million users in April last year. The latest investigation includes 264 more add-ons with 8.7 million installs, which suggests that this has more than doubled in about a year and a half. Many of these extensions are advertised as PDF converters, manual finders, safe search tools, and AI-powered assistants that can make daily specific tasks easier. These extensions are quite slippery and require little effort to achieve their goal. Once installed, Chrome’s built-in settings called "chrome_settings_override" lets an extension swap your default search engine without running any code. Then the search queries are routed through the servers controlled by extension operators. The servers add tracking identifiers and then redirect users to established search engines like Bing and Yahoo. This allows the operators to collect advertising revenue from their partnerships. That’s the payday. Many of these extensions are unlisted on the Chrome Web store. They are also promoted through shady ads on websites. In one example that involved an extension called Predator Search, Tuckner observed six identical searches landing on four different destinations, even though the extension remained the same. So, the operators can decide where you end up for your individual search query. Your Chrome extensions deserve a security check Here's how to check a shady Chrome extension While most of the extensions are already pulled, new ones keep coming up. The key takeaway is that the list of extensions in Socket’s findings could send users to phishing websites or pages with malicious downloads. This could become a major security problem later. If you’ve ever installed a free PDF tool extension or anything else on Chrome, a quick check is worth your time. You can do this by opening Chrome, clicking the three-dot menu in the top-right corner, and heading to Extensions > Manage Extensions. It also makes sense to remove anything that’s unfamiliar or unnecessary. Another precaution is to avoid installing extensions through advertisements or third-party sites. A free browser add-on isn’t worth handing over your search history. Source: Bleeping Computer