Chrome Extensions Hijack Searches for Ad Revenue
Researchers uncovered hundreds of malicious extensions that redirected user queries to generate unauthorized referral income.
Updated on Oct. 29, 2026 in Cybersecurity
Live Poll
Do you trust browser extensions to handle your search history and personal data securely?
Investigators have identified 319 malicious Chrome extensions that secretly hijacked user search queries over the past decade. The extensions, which total 13.4 million users, redirected traffic to generate advertising revenue for operators.
Why it matters
This widespread hijacking scheme highlights a persistent vulnerability in browser ecosystems where extensions exploit trust to profit from user search habits. By manipulating search providers, operators have successfully funneled traffic to platforms like Yahoo and Bing for years.
The malicious software utilized the chrome_settings_overrides.search_provider setting to replace default engines. Operators linked to Intango LTD and SecuryBrowse distributed 169 extensions that collectively impacted millions of active installs.
The players
Socket.dev
This organization specializes in software supply chain security and identified the massive network of malicious extensions.
John Tuckner
He is a security researcher who identified an additional 264 extensions that impacted 8.7 million users.
Intango LTD
This entity was linked to the operation of 111 extensions that accounted for approximately 2.2 million installations.
SecuryBrowse
This group managed 58 distinct extensions that affected an estimated 4.9 million users.
The details
The extensions were marketed as PDF converters, safe search tools, and AI helpers to lure unsuspecting users. Once installed, they used search syndication programs to ensure that every query processed through the browser resulted in shared advertising revenue for the developers.
Timeline
The malicious activity began in 2016.
Researchers published the full findings of the investigation on October 29, 2026.
The Tech Race
This discovery marks a significant expansion of known security risks within the Chrome Web Store extension ecosystem, showing how simple search-provider overrides can be scaled into a multi-million user advertising fraud network. It underscores an ongoing battle between browser maintainers and entities exploiting search syndication programs.
Users should regularly audit their installed browser extensions and remove any tools that were not intentionally added or appear to change default search behavior. If your browser suddenly redirects queries to unfamiliar pages, it is likely an indicator of unauthorized search provider settings.
The takeaway
Users must exercise extreme caution when installing browser utilities that promise free PDF conversion or AI-powered search features. Checking your browser's search provider settings is the most effective way to ensure your queries are not being hijacked for third-party profit.
Further reading
Learn more about the latest threats and vulnerabilities in Cybersecurity.
Live Poll
Do you trust browser extensions to handle your search history and personal data securely?
