Ordinateur portable affichant une page de moteur de recherche, illustrant les extensions Chrome malveillantes qui détournent les recherches

Searchjacked: 319 malicious Chrome extensions were hijacking your searches

An employee needs to convert a PDF or find a printer manual. They click an ad, install a small “free” tool from Chrome’s official store, and the problem is solved. What they don’t see: from that moment on, every web search they run first goes through an unknown server.

On October 29, 2026, researcher John Tuckner of Socket published an analysis of a large campaign dubbed “Searchjacked”: 319 malicious Chrome extensions that hijack their users’ searches. Here is how they work, why they are a business risk, and the settings that fix the problem on every workstation at once.

319 malicious Chrome extensions, 13.4 million installs

319

extensions identified by Socket

13.4M

combined installs, over about a decade according to Malwarebytes

264

new extensions, added to the 57 the researcher reported in April 2025

extensions in the “SecuryBrowse” wave, disguised as security tools, with 4.9 million users

The extensions posed as PDF converters, manual finders, “safe search” tools or AI search tools. Socket attributes them to a handful of organized operators. Most had been removed from the Chrome store at publication time, but BleepingComputer notes that new ones keep appearing. The full list is at the end of Socket’s report.

How a search gets hijacked

📢

1. Ad

An ad, including on Google Ads or the Bidbrain network, promises to solve an immediate need.

🔗

2. Direct link

The extension is unlisted: it sits in the official store but can’t be found through a normal search.

⚙️

3. Engine replaced

A simple Chrome setting (chrome_settings_overrides) replaces the default search engine, without asking for any permission.

🛰️

4. Relay server

Every search goes through the operator’s server, often tagged with an identifier unique to the user.

💰

5. Bing or Yahoo

The search lands on Bing or Yahoo with the operator’s partner code, earning them a commission.

The most troubling example in the report: an extension containing only a manifest file and icons. No scripts, no permissions requested. Nothing to alert a traditional antivirus or the user at install time.

Why this is about more than ads

For now, the operators make money from search commissions. But for a business, the risk goes further:

Your searches are read. Client names, technical problems, vendors under consideration, legal or financial questions: everything goes through a third-party server, tied to an identifier that can link one person’s searches over time.
The destination can change without an update. In Socket’s test, the Predator Search extension sent six identical searches to four different destinations. The server decides on each request. John Tuckner warns it could one day redirect to phishing pages or rigged downloads. Socket says it found no evidence this has happened yet.
The official store guarantees nothing. The extensions really were hosted by Google. As in our article on malicious ads, advertising is the way in.

Signs a workstation is affected

🔎

Search results look different

An unusual results page flashes before Bing or Yahoo, while the user thought they were searching on Google.

🧩

An unknown extension

A PDF, manual, “safe browsing” or AI search tool nobody remembers installing.

🔒

“Controlled by an extension”

In the search engine settings, Chrome says an extension is controlling this setting.

↪️

Chained redirects

The address bar goes through several unknown domains before showing results.

Malwarebytes points out an important nuance: the absence of the “controlled by an extension” notice does not prove that every installed extension is safe.

Cleaning up a workstation

⚙️ Chrome: check the search engine

⋮ More › Settings › Search engine

Engine used in the address barGoogle or the one your company chose

Notice “This setting is controlled by an extension”Absent

PDF, manual or “safe search” extension installed after an adRemove

Extension nobody uses anymoreRemove

In the address bar, chrome://extensions (or edge://extensions in Edge) shows every installed extension. Compare with the list Socket published, remove suspicious extensions, then run a full scan with your antivirus or EDR.

The real fix in a business: an approved extension list

Cleaning up one machine at a time doesn’t last: a new free tool will be installed next week. Chrome and Edge let you block all extensions by default and allow only the ones you have approved, using policies deployed through Intune, Group Policy or the Google Admin console:

Block by default

> ExtensionInstallBlocklist = *

No extension can be installed without approval.

Allow case by case

> ExtensionInstallAllowlist = [approved IDs]

Your password manager, your video-conferencing tool, and nothing else.

Set the search engine

> DefaultSearchProviderEnabled + DefaultSearchProviderSearchURL

The company’s chosen engine applies on every workstation.

Check it applied

> chrome://policy

Confirms on a workstation that the policies are received.

Before turning on blocking, take an inventory of the extensions actually in use so you don’t disrupt work. We already saw, with the rogue extension tied to the OVHcloud tool, that an extension can also be used to steal secrets.

How NeoTech can help

Our cybersecurity services take an inventory of the extensions installed on your workstations, build the approved list with you and deploy the Chrome and Edge policies. SentinelOne EDR scans the workstations, and our automated 24/7 monitoring with on-call technician intervention flags suspicious behaviour on monitored workstations.

Book your free cyber check

In 30 minutes, we look together at which extensions run on your workstations and how to control which ones can be installed.

👉 Book your free cyber check

Call us at 438-476-2322 or email info@neotechcloudsolutions.com.

Our office: 2572 boul. Daniel-Johnson, office 237, Laval.

Sources

Photo: cottonbro studio, Pexels (Pexels licence).