{"id":"CMP-202610-319-hidden-chrome-extensions-13-4m-users-hijack-the-default-","kind":"campaign","aliases":[],"related":[],"title":"319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')","description":null,"summary":"Socket Threat Research (Oct 29, 2026) found 319 browser extensions with about 13.4 million users, published since 2016 by a handful of operators (including Intango LTD, Tightrope Interactive, the 2024 SecuryBrowse wave, and an unattributed Bing-redirect group active since April 2025). The extensions have no permissions and no code. They only override the default search provider in the manifest, so permission-based extension reviews miss them. Every query goes to an operator proxy server that records the user's full search history, often tied to a unique ID, and decides per request where the search lands: Yahoo or Bing with the operator's partner tags, or other domains. Socket warns the proxies could selectively serve phishing or malware pages but did not report this happening. Most listings are unlisted in the Chrome Web Store and pushed through junk pop-over ads (Google Ads, Bidbrain) under names like Safe Web Search, PDF Manual Finder and AI search. Anyone whose employees use Chrome or Chromium browsers is at risk of leaking internal search terms.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Google Chrome","fixed":[],"vendor":"Google","component":"Chrome Web Store extensions"},{"name":"Chromium-based browsers","fixed":[],"vendor":"various","component":"browser extensions (search provider override)"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Inventory installed browser extensions for any that set chrome_settings_overrides.search_provider, and check whether the browser's default search engine is anything other than your approved one. Known indicators from Socket: extension ID odkcfoohjiicbelloepgcomekdknchjh (Predator Search); Safe Game Search (search.safesearchgame.com); redirect domains searchlio.net, searchtosearch.com, mcftink.com, newtabsearch.net, newtabhub.net, extension-search.online; search URLs carrying Yahoo hspart=/hsimp= (e.g. hspart=sz&hsimp=yhs-026) or Bing PC=INES* partner codes. Socket's full list of 319 extension IDs is in the write-up.","fix":"Remove the extensions found and reset the default search engine. In Chrome Enterprise or Edge policy, set an extension allowlist (ExtensionInstallAllowlist/Blocklist) and enforce the default search provider (DefaultSearchProviderEnabled, DefaultSearchProviderSearchURL) so extensions cannot override it. Do not treat an extension that asks for zero permissions as safe.","status":"open","published_at":null,"first_seen_at":"2026-10-29T05:33:21+00:00","triaged_at":"2026-10-29T05:33:21+00:00","updated_at":"2026-10-29T05:33:21+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202610':29A '-319':30A '-4':36A '13':35A '13.4':5A,66B '2016':71B '2024':83B '2025':96B '2026':59B '29':58B '319':1A,61B 'activ':93B 'ad':198B,200B 'ai':212B 'anyon':214B 'april':95B 'base':118B 'based':48A 'bidbrain':201B 'bing':90B,155B 'bing-redirect':89B 'browser':62B,221B 'browsers':49A 'campaign':50B 'chrome':3A,33A,45A,188B,218B 'chromium':47A,220B 'chromium-based':46A 'cmp':28A 'code':104B 'could':169B 'decid':146B 'default':10A,42A,109B 'domain':164B 'earli':52B 'early-warn':51B 'employe':216B 'engin':12A 'everi':15A,123B 'extens':4A,63B,98B,119B 'extensions':34A 'finder':210B 'found':60B 'full':136B 'goe':125B 'googl':199B 'google':44A 'group':92B 'hand':74B 'happen':181B 'hidden':2A,32A 'hidden-chrome-extensions':31A 'hijack':8A,40A 'histori':138B 'id':144B 'includ':77B 'intango':78B 'interact':81B 'intern':227B 'junk':194B 'land':152B 'leak':226B 'like':204B 'list':183B 'log':21A 'ltd':79B 'm':6A,38A 'm-users-hijack-the-default':37A 'malwar':174B 'manifest':114B 'manual':209B 'million':67B 'miss':121B 'name':203B 'oct':57B 'often':139B 'oper':18A,76B,128B,158B 'overrid':107B 'page':175B 'partner':160B 'pdf':208B 'per':147B 'permiss':101B,117B 'permission-bas':116B 'phish':172B 'pick':24A 'pop':196B 'pop-ov':195B 'provid':111B 'proxi':19A,129B,168B 'publish':69B 'push':192B 'queri':22A,124B 'record':132B 'redirect':25A,91B 'report':179B 'request':148B 'research':56B 'review':120B 'risk':224B 'rout':14A 'safe':205B 'search':11A,16A,110B,137B,151B,207B,213B,228B 'searchjack':27A 'searchjacked':43A 'securybrows':84B 'select':170B 'serv':171B 'server':130B 'sinc':70B,94B 'socket':26A,54B,165B 'store':190B 'tag':161B 'term':229B 'the':41A 'threat':55B 'tie':140B 'tightrop':80B 'unattribut':88B 'uniqu':143B 'unlist':185B 'use':217B 'user':7A,68B,134B 'users':39A 'warn':53B,166B 'wave':85B 'web':189B,206B 'whose':215B 'yahoo':153B","nicknames":["Searchjacked"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-29T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-319-hidden-chrome-extensions-13-4m-users-hijack-the-default-","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-29T05:33:21+00:00","fetched_at":"2026-10-29T05:33:21+00:00","note":null}],"documents":[{"id":14398,"url":"https://x.com/feross/status/2115673050821566685","title":"@feross: A browser extension with no permissions and no code can still see every search y","kind":"post","source":"x","publisher":null,"text":"A browser extension with no permissions and no code can still see every search you make.\n\n@SocketSecurity found 319 extensions with 13.4M users that just swap the default search engine for the operator's proxy. The proxy decides where each query lands.\n\nhttps://t.co/yeQcnVRIix\n\nlikes 3 reposts 1","published_at":"2026-10-29T05:12:17+00:00","relation":"describes","confidence":null,"note":null},{"id":14415,"url":"https://t.co/yeQcnVRIix","title":"Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users (Socket Threat Research, John Tuckner)","kind":"blog","source":"analyst","publisher":null,"text":"Socket: 319 Chrome extensions (~13.4M users, 264 newly identified, 8.7M new users) since 2016 override the default search provider via manifest chrome_settings_overrides.search_provider, with no permissions or code. Queries route through operator proxy servers that capture full search history and choose redirects per request (Yahoo hspart/hsimp, Bing PC=/PTAG= partner tags; sometimes elsewhere). Most are unlisted in Chrome Web Store and pushed via Google Ads, Bidbrain pop-over/pop-under ads under names like Safe Web Search, PDF Manual Finder, AI search. Examples: Safe Game Search (search.safesearchgame.com); Predator Search odkcfoohjiicbelloepgcomekdknchjh (50k users) redirecting to Yahoo hspart=sz&hsimp=yhs-026, searchlio.net, searchtosearch.com, mcftink.com. Operators: Intango LTD (~111 extensions, ~2.2M installs, ~279 domains, e.g. newtabsearch.net, newtabhub.net, Bing PC=INES*), Tightrope Interactive (307 domains), SecuryBrowse wave 2024 (58 extensions, ~4.9M), unattributed Bing-redirect group since April 2025 (37 extensions, 15 publishers updated within four days in June 2026).","published_at":"2026-10-29T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":13749,"url":"https://socket.dev/blog/searchjacked?utm_medium=feed","title":"Socket: Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users","kind":"blog","source":"blog","publisher":null,"text":"Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users\n\n319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.","published_at":"2026-10-29T02:01:54+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}