319 Chrome Extensions Hijack Searches via Minimal Manifests, Affecting 13.4M Users
Security firm Socket identified 319 Chrome extensions with 13.4 million total installs that hijack default search settings. These add-ons, often disguised as PDF converters or AI tools, route queries through operator-controlled proxies to Bing and Yahoo for ad revenue. The technique exploits Chrome's 'chrome_settings_overrides' feature, requiring no code or sensitive permissions. While currently focused on monetization, the infrastructure allows potential redirection to phishing sites. Most extensions were unlisted and promoted via ads, with clusters linked to operators like Intango LTD and SecuryBrowse.