# Chrome extension search hijacking campaign

> Developing situation record from CLSTR: https://clstr.news/situations/chrome-extension-search-hijacking-campaign
> Updated: 2026-10-31T17:48:12.000Z. Sources: 15. Developments: 2.

A cybersecurity investigation by Socket has identified a large scale search hijacking campaign involving 319 Google Chrome extensions. These extensions, which have reached approximately 13.4 million installations, often masquerade as legitimate tools such as PDF converters, antivirus software, or AI powered search assistants.

The campaign exploits a native Chrome feature called ‘chrome_settings_overrides’ to discreetly replace the browser’s default search engine. User queries are routed through operator controlled proxy servers before being sent to engines like Bing or Yahoo. This method allows organized actors to intercept data and generate advertising revenue through search syndication and affiliate commissions.

While the primary objective appears to be ad fraud, researchers warn that the infrastructure poses privacy and security risks, as the proxy servers could potentially redirect users to phishing sites or malicious downloads.

## Timeline

### 2026-10-31: Google Chrome extensions affect 13 million users

Over 13 million Google Chrome users have been affected by 319 extensions that divert search queries through third-party servers to claim affiliate commissions.

2 sources. https://clstr.news/cluster/google-chrome-extensions-affect-13-million-users

### 2026-10-29: Socket identifies 319 Chrome extensions hijacking 13.4 million searches

Socket researchers found 319 Chrome extensions with 13.4 million installs that hijack searches to generate ad revenue via proxy servers, posing privacy and security risks.

13 sources. https://clstr.news/cluster/chrome-extensions-hijack-searches-for-134-million-users

---
Cite as: Chrome extension search hijacking campaign. CLSTR, https://clstr.news/situations/chrome-extension-search-hijacking-campaign