Unlisted Chrome extensions hijacked search on a reported 13.4 million installs

A browser extension does not need a famous bug to sit between a person and every query they type. It needs a listing, or a link, and the right to replace the search box the browser already trusted.

On October 29, 2026, BleepingComputer reported a Socket tally of that pattern: 319 Chrome extensions and a combined 13.4 million reported installations. The work expands a finding Socket researcher John Tuckner published in April 2025, when the count was 57 extensions and about 6 million users. The newer pass names 264 further add-ons. Store install counters are reported figures, and they move; the scale is the point. This is not a niche toolkit. It is a large set of ordinary-looking add-ons.

They present themselves as PDF converters, manual finders, safe-search helpers, and AI search tools. What they do, in the research, is replace the browser’s default search engine and send each query through a server the operator controls before it lands on Bing or Yahoo. The commercial aim is a partner referral fee. The security fact is that the operator, not the user, chooses the next hop.

Unlisted is not the same as unavailable

Many of these extensions do not appear when someone searches the Chrome Web Store. They are unlisted, and they are pushed through advertisements on other sites. A store badge on a page the user reached from an ad is not a review. It is a download link that happens to live on Google’s domain.

The hijack can be small. Chrome lets an extension declare a replacement search provider. Tuckner found samples that were little more than that declaration and a set of icons, with no background script and no extra permissions a reviewer would call loud. This desk will not show the manifest. The defender’s reading is the reverse of a recipe: an extension with almost nothing in it can still own the search box, so a review that only hunts for broad permissions will miss the quiet ones.

Two clusters stood out. One, described as Bing-Search, was 37 extensions and about 2.2 million users, often promoted through Bidbrain ads. Another, SecuryBrowse, was 58 extensions and about 4.9 million users, under security-flavored names such as Fire Shield, Securify, and WatchTower. A lock in the title is not a control.

Socket said most of the extensions in the report had been pulled from the store by the time it was published. New ones keep showing up. Taking a listing down does not uninstall the copy already sitting on a laptop. BleepingComputer asked Google for comment and had not received one when the story ran.

Referral fees are the alibi

The money explains why the campaign looks like adware. It does not limit what the middle server can do next. The destination of a query can change without shipping a new extension. Today’s landing page is a search engine carrying a partner tag. A later one can be a phishing site or a download the user did not ask for.

One add-on in the report, Predator Search, made that concrete. The same query, repeated, ended in different places: a partner-tagged Yahoo result, other landing pages, and at least one error page. The extension did not change between tries. The server did. That is the property an enterprise should care about. The operator who can see the query can, later, decide the answer.

What to do

Start with the browsers you manage.

Turn on an extension allow list and make the default deny. A presence in the store is not an approval. Unlisted items, items installed from an advertisement, and items that change the default search engine should be exceptions a person has to justify. Enterprise policy can force the search provider and can block extensions that are not on the list. Use both. A user who needed a PDF tool can be given one you already trust.

If you do not manage the browser, the step is plainer. Open the extensions page. Remove anything you do not remember installing, and remove anything named in Socket’s report. Then run the endpoint product you already pay for. Do not install a browser add-on from an ad, a coupon page, or a search box that arrived beside a download.

Watch the symptom after the names go stale. A homepage or search engine that changed without a ticket is the incident. So is a query that detours through a domain your proxy has never seen. Log the extension inventory. The next cluster will not reuse these titles, and a removed store page will not clean up the machines that installed last month’s copy.

This briefing relies on public reporting by BleepingComputer and research published by Socket. It does not describe how the extensions are built.