How 319 Chrome Extensions Redirected Searches and What It Means for Users and SOCs

A sprawling network of 319 browser extensions has been tied to search hijacking that affected an estimated 13.4 million users over the past decade. Marketed as benign utilities — PDF converters, safe search tools, finders, and AI helpers — these add-ons quietly routed user queries through operator-controlled servers before forwarding results to mainstream engines such as Yahoo or Bing. The result: referral revenue for operators, a persistent intermediary with visibility into searches, and a stealthy privacy exposure that can be difficult to detect from the extension’s surface behavior.

How the hijack works

Extensions abused Chrome’s chrome_settings_overrides.search_provider setting to replace a user’s default search engine. In many cases the extension contained nothing more than a manifest and icons; there were no background workers, content scripts, toolbar UI, or extra permissions that would tip off a reviewer. Chrome shows an installation prompt about changing search settings, but that dialog does not make it clear where queries are routed, creating a gap that operators exploited.

Scope and timeline

Socket.dev’s investigation — published October 29, 2026 — identified 319 extensions in total across multiple campaigns and time periods. The headline figure aggregates findings across years; it does not prove that 13.4 million users remain actively affected today. Researchers also disclosed 264 newly identified extensions affecting roughly 8.7 million users in a later reporting window. Some of the activity stretches back to 2016 and shows long-lived patterns tied to recurring advertising and domain infrastructure.

Distribution, operator links, and monetization

Many of the identified extensions were unlisted in the public Chrome Web Store and only accessible via direct links. Paid traffic — including popovers and popunders — led users to landing pages that pitched useful tools and encouraged installation. Operators monetized redirected searches through search syndication programs, which credit partners for traffic and share advertising revenue. Tracking parameters embedded in redirected queries allowed attribution to specific partners, and coordinated updates across seemingly separate publishers suggested centralized control.

Clusters and infrastructure

Socket.dev attributed clusters of extensions to specific operator groups by combining store listings, privacy policies, Google Ads Transparency records, Censys scans, urlscan captures, and DecryptAds data. One cluster linked about 111 extensions and roughly 2.2 million installs to Intango LTD; another (“SecuryBrowse”) accounted for 58 extensions and approximately 4.9 million users. A Bing-focused cluster of 37 extensions showed common Bing partner codes and synchronized updates across publisher identities.

Privacy and security implications

Even when the forwarded results look familiar, the presence of an intermediary means queries are no longer private or direct. Search traffic can reveal sensitive personal information such as health concerns, financial matters, and workplace projects. Socket.dev observed cases where identical queries produced different outcomes depending on server-side decisions: direct results, alternate landing pages, additional redirect chains, or errors. While most observed traffic bore referral tags rather than confirmed phishing payloads, the operator-controlled proxy introduces both visibility and the potential for more harmful redirections.

Indicators of compromise (IoCs):

Type	Indicator	Context
Extension ID	odkcfoohjiicbelloepgcomekdknchjh	Predator Search
Domain	search.safesearchgame[.]com	Search proxy
Domain	suggest.safesearchgame[.]com	Query suggestions
Domain	searchlio[.]net	Observed destination
Domain	searchtosearch[.]com	Redirect intermediary
Domain	mcftink[.]com	Intermediate results
Domain	extension-search[.]online	Historical hijacker
Tracking parameters	hspart=sz&hsimp=yhs-026	Predator Search referral
Bing codes	PC=3FPX , PC=3VSS	Bing-focused cluster
Bing codes	PC=3QCV , PC=3CGP	SecuryBrowse cluster

Defensive takeaways for users and organizations

• Check your browser’s default search engine and remove unfamiliar add‑ons.
• Include search configuration checks in extension audits rather than relying solely on permission reviews.
• For organizations: investigate unexplained search redirects, restrict unapproved extensions, and consider managed allowlists or centralized extension controls.

Socket.dev’s analysis shows that following advertising relationships and shared infrastructure can reveal operator networks even after individual store listings are taken down.

Conclusion

This case highlights a subtle but powerful abuse vector: changing search behavior via a legitimate extension setting to monetize traffic and observe queries without needing broad permissions. The attack surface is small in code but wide in reach, and defenders must expand routine checks to include search configuration and advertising/infrastructure link hunting to see the bigger picture.