Overview
- Socket researcher John Tuckner published an October 2026 report identifying 319 Chrome extensions with about 13.4 million combined installs that silently replaced users’ default search engines.
- The extensions routed every search through operator‑controlled proxy servers that injected partner IDs so operators could earn referral payments from Bing and Yahoo.
- Many add‑ons used Chrome’s built‑in chrome_settings_overrides and needed almost no code or permissions, with some listings consisting only of a manifest file and icons.
- Operators distributed the unlisted store entries via shady web ads and landing pages, which let users install extensions that do not appear in Chrome Web Store search results.
- Most flagged extensions were removed from the store after the report, but researchers warn new variants keep appearing and advise users to remove suspicious extensions, check search settings, and run full antivirus scans.