# Chrome extensions with 13.4 million installs caught hijacking searches

DevFeed: [Chrome extensions with 13.4 million installs caught hijacking searches](<https://devfeed.tech/articles/chrome-extensions-with-13-4-million-installs-caught-hijacking-searches-106424.md>)

Original publisher: [Read original article](<https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/>)

Author: Bill Toulas

Published: 2026-10-29T16:10:31Z

Content type: news

Language: en

Sources: [BleepingComputer](<https://devfeed.tech/sources/bleepingcomputer.md>)

Topics: [Chrome extension](<https://devfeed.tech/topics/chrome-extension.md>), [Google Chrome](<https://devfeed.tech/topics/google-chrome.md>)

Tags: [ad-fraud](<https://devfeed.tech/tags/ad-fraud.md>), [add-ons](<https://devfeed.tech/tags/add-ons.md>), [advertising](<https://devfeed.tech/tags/advertising.md>), [ai-search](<https://devfeed.tech/tags/ai-search.md>), [bing](<https://devfeed.tech/tags/bing.md>), [browser-extension](<https://devfeed.tech/tags/browser-extension.md>), [campaign](<https://devfeed.tech/tags/campaign.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [chrome-extension](<https://devfeed.tech/tags/chrome-extension.md>), [code](<https://devfeed.tech/tags/code.md>), [computer-help](<https://devfeed.tech/tags/computer-help.md>), [computer-security](<https://devfeed.tech/tags/computer-security.md>), [computers](<https://devfeed.tech/tags/computers.md>), [extensions](<https://devfeed.tech/tags/extensions.md>), [fraud](<https://devfeed.tech/tags/fraud.md>), [google-chrome](<https://devfeed.tech/tags/google-chrome.md>), [hijack](<https://devfeed.tech/tags/hijack.md>), [hijacking](<https://devfeed.tech/tags/hijacking.md>), [infosec](<https://devfeed.tech/tags/infosec.md>), [infosec-computer-security](<https://devfeed.tech/tags/infosec-computer-security.md>), [installations](<https://devfeed.tech/tags/installations.md>), [linux](<https://devfeed.tech/tags/linux.md>), [mac](<https://devfeed.tech/tags/mac.md>), [malicious](<https://devfeed.tech/tags/malicious.md>), [malvertising](<https://devfeed.tech/tags/malvertising.md>), [malware](<https://devfeed.tech/tags/malware.md>), [malware-removal](<https://devfeed.tech/tags/malware-removal.md>), [revenue](<https://devfeed.tech/tags/revenue.md>), [search](<https://devfeed.tech/tags/search.md>), [search-hijacker](<https://devfeed.tech/tags/search-hijacker.md>), [security](<https://devfeed.tech/tags/security.md>), [servers](<https://devfeed.tech/tags/servers.md>), [spyware](<https://devfeed.tech/tags/spyware.md>), [support](<https://devfeed.tech/tags/support.md>), [tech-support](<https://devfeed.tech/tags/tech-support.md>), [technical-support](<https://devfeed.tech/tags/technical-support.md>), [tracking](<https://devfeed.tech/tags/tracking.md>), [users](<https://devfeed.tech/tags/users.md>), [virus](<https://devfeed.tech/tags/virus.md>), [virus-removal](<https://devfeed.tech/tags/virus-removal.md>), [windows](<https://devfeed.tech/tags/windows.md>), [yahoo](<https://devfeed.tech/tags/yahoo.md>)

## AI overview

Socket's report identifies 319 Chrome extensions with a combined 13.4 million reported installations that redirect searches through operator-controlled proxy servers to Bing or Yahoo, generating partner referral revenue. The extensions pose a broader risk because operators can change destinations without updating the add-ons; the report describes identical searches reaching different sites and warns they could be redirected to phishing pages or malicious downloads. Many extensions use Chrome's `chrome_settings_overrides` setting and require little code. The excerpt says most had been removed from the Chrome Web Store when the report was published, while new ones continued to appear. Socket recommends uninstalling listed extensions, running a full antivirus scan, and avoiding unnecessary add-ons from unknown publishers.

## Source excerpt

A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising revenue from Bing and Yahoo. [...]