Researchers at Socket have identified 319 Chrome extensions tied to about 13.4 million reported installs that quietly changed users’ default search provider, eSecurity Planet reported on October 30.
The extensions used Chrome’s built-in settings override to route searches through servers controlled by the operators. That let them monitor queries and earn advertising referral revenue. Some contained almost no executable code. Most were unlisted on the Chrome Web Store and promoted through paid ads.
The operators could later redirect searches to malicious sites without updating the extensions. Users should review chrome://extensions for unfamiliar tools, compare extension IDs against Socket’s published list, remove anything suspicious, restore their preferred search engine and scan the device.