Socket investigation published October 29, 2026
319 Chrome Extensions Routed Searches Through Operator Servers: 13.4 Million Installs Over a Decade
Researchers at Socket published an investigation on October 29 identifying 319 Chrome extensions with about 13.4 million installs accumulated over roughly a decade that take over the browser default search engine and route every query through servers their operators control before delivering results from Yahoo or Bing. The figure combines years of findings and does not establish that 13.4 million people remain actively affected today. The new research by John Tuckner adds 264 extensions and another 8.7 million users to an April 2025 discovery of 57 extensions with 6 million users, with the oldest dating to 2016. The extensions pose as PDF converters, manual finders, safe search tools, and AI search helpers; most were unlisted in the Chrome Web Store and were installed through advertisements on other websites. The technique needs almost no code: Chrome allows an extension to replace the default search provider through the chrome_settings_overrides setting in its manifest, and one analyzed extension, Safe Game Search, contained only a manifest and three icons, with no background scripts and no requested permissions beyond its search configuration, which is why a permissions review alone can miss it. Operators earn Bing and Yahoo referral fees through partner identifiers, while the proxy sees the full query stream and chooses each destination: Socket ran six identical searches through one extension, Predator Search, and received four different outcomes, including Yahoo results, an alternative landing page, a redirect chain, and an error page. Socket observed mostly referral-tagged traffic and does not report confirmed phishing delivery, so malicious redirection is a documented capability and a warned escalation, not an established outcome. Socket linked clusters to a handful of organized operators, including about 111 extensions and roughly 2.2 million installs attributed to Intango, a SecuryBrowse cluster of 58 extensions and about 4.9 million users, and a newer Bing-focused group of 37 extensions. Most listed extensions had already been removed from the store when the report published, but new ones keep appearing.
Executives
Search queries are a record of intent: health concerns, financial problems, internal projects, and acquisition targets all pass through that box. For a decade, a set of extensions quietly inserted a paid intermediary into that stream inside ordinary browsers, and the same proxy that collects referral fees can choose a different destination for any query at any time. Browser extensions belong in the same inventory and approval discipline as any other software.
CIO / CISO
Move from user discretion to an allowlist: restrict Chrome extensions in managed browsers to approved IDs, and include the search provider setting in your browser configuration baseline, because these extensions requested few or no permissions and would pass a permissions-only review. Use Socket published extension ID list to check your fleet, and treat unexplained changes to the default search engine as a reportable configuration drift event.
Engineers
Check both places: the installed extension list against Socket IDs, and Settings, Search engine, for a default provider the user did not choose. An extension with a manifest-only footprint leaves little to find in process or network telemetry beyond the redirect itself, so configuration auditing is the reliable detection. Removing the extension and restoring the search provider are both required; one without the other leaves the routing in place or the cause in place.
Everyone (non-IT)
Take two minutes today: open your browser extensions list and remove anything you do not remember installing, especially PDF, safe search, or AI search add-ons, then check that your default search engine is the one you picked. Searches you type can reveal a great deal about you, and they should go to the provider you chose, not through a stranger server first.