319 Chrome Extensions Hijack Searches via Minimal Manifests, Affecting 13.4M Users

Key points

• Socket’s John Tuckner identified 319 extensions with 13.4 million cumulative installs, expanding on earlier findings of 57 extensions.
• Extensions use Chrome's 'chrome_settings_overrides' to replace search providers without requesting permissions or running scripts.
• Searches are routed through proxy servers to generate referral revenue from Bing and Yahoo syndication partners.
• The proxy architecture allows operators to dynamically change destinations, potentially enabling phishing or malware delivery.
• Most extensions were unlisted in the Chrome Web Store and distributed via deceptive advertisements on third-party sites.

Background

This incident follows recent concerns about browser extension security, including the 'BragJack' attack vector that hijacks AI agents in Chromium-based browsers. While previous issues involved complex code exploits, this campaign relies on configuration changes, highlighting a different detection blind spot. The 13.4 million figure represents cumulative installs over a decade, not necessarily active users, as noted by GBHackers News.

How outlets are covering it

BleepingComputer and Digital Trends emphasize the ease of the attack, noting that some extensions contained only a manifest and icons. They highlight the risk of future malicious redirections, with Tuckner warning that the proxy could pivot to phishing. GBHackers News provides a more technical nuance, clarifying that while the extensions lack sensitive permissions, they still introduce an intermediary that can observe queries. It also notes that not all 319 extensions are permission-free, as earlier research by Secure Annex found broader permissions in some cases. All sources agree on the need for users to audit their installed extensions and default search settings.

Why it matters

This campaign demonstrates a low-effort, high-impact method for compromising user privacy and monetizing search traffic. The reliance on Chrome's built-in settings rather than executable code makes these extensions harder to detect via traditional permission reviews. The potential for dynamic redirection means that even currently benign extensions could become malicious without user notification, posing a significant risk to browser integrity and user data.

What to watch

Users should uninstall unrecognized extensions and verify their default search engine settings. Security teams should monitor for unexplained changes in search providers and inspect redirect chains. Google has not yet responded to inquiries regarding the removal of these extensions, but new variants are expected to appear as operators adapt to takedowns.