319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')

Socket Threat Research (Oct 29, 2026) found 319 browser extensions with about 13.4 million users, published since 2016 by a handful of operators (including Intango LTD, Tightrope Interactive, the 2024 SecuryBrowse wave, and an unattributed Bing-redirect group active since April 2025). The extensions have no permissions and no code. They only override the default search provider in the manifest, so permission-based extension reviews miss them. Every query goes to an operator proxy server that records the user's full search history, often tied to a unique ID, and decides per request where the search lands: Yahoo or Bing with the operator's partner tags, or other domains. Socket warns the proxies could selectively serve phishing or malware pages but did not report this happening. Most listings are unlisted in the Chrome Web Store and pushed through junk pop-over ads (Google Ads, Bidbrain) under names like Safe Web Search, PDF Manual Finder and AI search. Anyone whose employees use Chrome or Chromium browsers is at risk of leaking internal search terms.

Summary written from the sources below. Check the originals before acting.