---
id: "CMP-202610-319-hidden-chrome-extensions-13-4m-users-hijack-the-default-"
kind: "campaign"
aliases: []
title: "319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Google Chrome", "fixed": [], "vendor": "Google", "component": "Chrome Web Store extensions"}, {"name": "Chromium-based browsers", "fixed": [], "vendor": "various", "component": "browser extensions (search provider override)"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T05:33:21+00:00"
updated_at: "2026-10-29T05:33:21+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T05:33:21+00:00"}]
---

# 319 hidden Chrome extensions (13.4M users) hijack the default search engine and route every search through operator proxies that log queries and pick redirects (Socket 'Searchjacked')

Socket Threat Research (Oct 29, 2026) found 319 browser extensions with about 13.4 million users, published since 2016 by a handful of operators (including Intango LTD, Tightrope Interactive, the 2024 SecuryBrowse wave, and an unattributed Bing-redirect group active since April 2025). The extensions have no permissions and no code. They only override the default search provider in the manifest, so permission-based extension reviews miss them. Every query goes to an operator proxy server that records the user's full search history, often tied to a unique ID, and decides per request where the search lands: Yahoo or Bing with the operator's partner tags, or other domains. Socket warns the proxies could selectively serve phishing or malware pages but did not report this happening. Most listings are unlisted in the Chrome Web Store and pushed through junk pop-over ads (Google Ads, Bidbrain) under names like Safe Web Search, PDF Manual Finder and AI search. Anyone whose employees use Chrome or Chromium browsers is at risk of leaking internal search terms.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Google Chrome affected ? fixed ?
- :Chromium-based browsers affected ? fixed ?

## How to check

Inventory installed browser extensions for any that set chrome_settings_overrides.search_provider, and check whether the browser's default search engine is anything other than your approved one. Known indicators from Socket: extension ID odkcfoohjiicbelloepgcomekdknchjh (Predator Search); Safe Game Search (search.safesearchgame.com); redirect domains searchlio.net, searchtosearch.com, mcftink.com, newtabsearch.net, newtabhub.net, extension-search.online; search URLs carrying Yahoo hspart=/hsimp= (e.g. hspart=sz&hsimp=yhs-026) or Bing PC=INES* partner codes. Socket's full list of 319 extension IDs is in the write-up.

## Fix

Remove the extensions found and reset the default search engine. In Chrome Enterprise or Edge policy, set an extension allowlist (ExtensionInstallAllowlist/Blocklist) and enforce the default search provider (DefaultSearchProviderEnabled, DefaultSearchProviderSearchURL) so extensions cannot override it. Do not treat an extension that asks for zero permissions as safe.

## Timeline

- 2026-10-29T05:33:21+00:00 analyst

## Documents

- [describes] @feross: A browser extension with no permissions and no code can still see every search y https://x.com/feross/status/2115673050821566685
- [describes] Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users (Socket Threat Research, John Tuckner) https://t.co/yeQcnVRIix
- [mentions] Socket: Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users https://socket.dev/blog/searchjacked?utm_medium=feed

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_