319 Suspicious Chrome Extensions Hijack Default Search Settings Without Sensitive Permissions

An investigation into browser extensions identified 319 suspicious extensions linked to about 13.4 million reported users, exposing a search-hijacking ecosystem operating since 2016.

Marketed as manual finders, PDF converters, safe search utilities, and AI search tools, the extensions funnel queries through operator-controlled infrastructure before delivering Yahoo or Bing results.

The Searchjacked investigation expands earlier research with 264 newly identified extensions accounting for another 8.7 million reported users.

These cumulative figures span a decade and should not be interpreted as a verified count of people currently affected.

The technical finding concerns Chrome’s chrome_settings_overrides.search_provider configuration.

An extension can replace the default search provider through its manifest, without requesting sensitive permissions, running a background service worker, injecting content scripts, or offering a functional interface.

One analyzed extension, Safe Game Search, consisted of its manifest and three icons.

Its configuration set an operator-controlled search endpoint as the default and supplied a separate autocomplete endpoint. Browser configuration, rather than executable extension logic, performed the interception.

This distinction creates a detection blind spot: permission reviews alone cannot establish whether an extension exposes browsing activity.

Instead of sending searches directly to established providers, these extensions introduce an intermediary that can observe queries and associate them with identifiers or network information.

Operators monetize the resulting traffic using search syndication arrangements, attaching Yahoo’s hspart and hsimp parameters or Bing’s PC and PTAG values.

The proxy also gives operators control over each destination. Predator Search, listed with 50,000 users, demonstrated this variability: six identical searches produced four outcomes, including Yahoo results, intermediate domains, and a Cloudflare error page.

Chrome Extensions Hijacking

That behavior establishes server-side routing flexibility, not confirmed malware delivery. The investigation describes phishing pages, manipulated results, and malicious downloads as potential consequences; it does not demonstrate those outcomes occurring.

Likewise, visibility into queries does not independently prove that every operator retains or sells them.

Socket Researchers said that, Chrome displays a search-change prompt during installation, but that warning does not fully explain the downstream proxy infrastructure or subsequent routing decisions.

Google Ads and Bidbrain campaigns promoted branded landing pages that encouraged installation, often through popovers or popunders advertising seemingly useful browser features.

Researchers associated approximately 111 extensions and 2.2 million installs with Intango LTD. The SecuryBrowse cluster accounted for 58 extensions and approximately 4.9 million users, while a newer Bing-focused group contained 37 extensions.

Shared partner identifiers and synchronized updates helped connect apparently separate publishers.

The findings build on Secure Annex’s earlier investigation, which examined hidden security-themed extensions and suspicious functionality.

Most identified extensions were unlisted in the Chrome Web Store, making direct links and advertising central to distribution.

That earlier work also documented extensions carrying broader permissions, underscoring that the entire 319-extension population should not be characterized as permission-free.

Investigators combined store listings, privacy policies, advertising transparency records, Censys, urlscan, and DecryptAds to map infrastructure and attribution.

For defenders, the practical lesson is to inspect installed extensions alongside default search providers and redirect chains. Organizations should restrict unauthorized extensions and investigate unexplained search changes.

Users should remove unfamiliar add-ons and verify their configured search engine. A minimal manifest is not, by itself, evidence of minimal security risk.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.