Google Chrome extensions affect 13 million users

A cybersecurity investigation by Socket has revealed that 319 Google Chrome extensions, totaling approximately 13.4 million installations, have been used to divert user search queries. These extensions often masquerade as legitimate tools, such as PDF converters, manual search engines, antivirus software, or AI-based search assistants.

According to security researcher John Tuckner, the campaign is attributed to a small number of organized actors. The extensions exploit a native Chrome feature called “chrome_settings_override” to discreetly replace the browser’s default search engine. Instead of searching directly, user queries are routed through third-party servers before being sent to engines like Bing or Yahoo. This process allows the operators to intercept data and claim affiliate commissions from the redirected search traffic.