319 Chrome Extensions Hijacked Searches for 13.4M Users

You installed a PDF converter or a "safe search" add-on that never asked for a single permission. Yet every query you typed into the address bar since then has passed through a server you have never heard of, run by a company you never chose. On October 29, 2026, Socket researcher John Tuckner published Searchjacked, an investigation into 319 browser extensions that hijack searches for roughly 13.4 million users.

Key Takeaways

• Socket identified 319 Chrome extensions, installed by roughly 13.4 million users over about a decade, that replace the default search engine with an operator controlled proxy.
• The chrome_settings_overrides manifest key does all the work, so many of these extensions ship with no permissions, no background script, and no content scripts.
• Operators earn money by forwarding queries to Yahoo and Bing with syndication partner IDs, and the proxy can change where a search lands without any extension update.
• Intango LTD alone is tied to 111 extensions, while an unattributed "SecuryBrowse" cluster of 58 security branded extensions reached about 4.9 million users.
• Google had not responded to BleepingComputer's request for comment at publication time.

What Did Socket Find?

Socket found 319 browser extensions whose main job is to take over your search engine. According to the Socket report, 200 of them (about 5.68 million users) trace back to identified companies, and 119 (about 7.76 million users) come from operators Socket could not name.

This is a sequel. BleepingComputer notes that Tuckner's April 2025 research covered 57 Chrome extensions with 6 million users, and the new report adds "264 newly identified add-ons with another 8.7 million users." The known footprint of this scheme more than doubled in 18 months.

The extensions pose as PDF converters, manual finders, safe search tools, AI search helpers, weather tools, and security products. Socket only published one extension ID in the report. Here are the clusters and the extensions it names:

Kinner Lake Ltd (6 extensions, 300,000 users), Tightrope Interactive (18), System1 (9), and Perion Network (4) round out the larger identified operators.

How Does the Search Hijack Work?

The hijack works through a single manifest key, not malicious code. Chrome's settings override documentation lets an extension declare a search_provider with is_default set to true and its own search_url. Socket's sample, a "Safe Game Search" manifest, points that URL at https://search.safesearchgame.com/query?q={searchTerms} and adds a matching suggest_url, so even your autocomplete keystrokes go to the operator.

That sample has no permissions, no background service worker, no content scripts, and no UI. Tuckner points out that the override "is not even code that executes." A scanner hunting for suspicious JavaScript has nothing to read.

The proxy decides where you land

Once the extension is installed, each query hits the operator's server first. That server records the query and then forwards it to Yahoo or Bing with a syndication partner tag, such as Yahoo's hspart= and hsimp= parameters or Bing's PC= partner code. The operator collects a share of the ad revenue your search generates.

Socket ran six identical searches through Predator Search and got four different outcomes: Yahoo with hspart=sz&hsimp=yhs-026 tags, a landing page on searchlio.net, a hop through searchtosearch.com and mcftink.com before Yahoo, and a Cloudflare error page. In Socket's words, "The extension never changed; the proxy chose each destination as the search came in."

Why Did Chrome's Defenses Miss Them?

Chrome's own rules reward the minimal design these operators use. The Chrome developer documentation states that extensions which modify only a single setting, without other permissions, "do not get a confirmation dialog." Asking for extra permissions alongside the override is what triggers a warning. So the stripped down, permissionless extension is both the hardest to flag in code review and the one least likely to show you a prompt.

Distribution avoids the store's front door too. Socket says "A majority of the search hijacking extensions we found are unlisted in the Chrome Web Store," meaning they never show up in store search. Users arrive through popover and popunder ads, including Google Ads, that lead to landing pages with install buttons. Socket counted 16 ads on Intango's verified Google Ads account in October 2026, and BleepingComputer reports the Bing-Search cluster was usually pushed through Bidbrain advertisements.

Takedowns have not kept pace. Twelve Intango extension IDs were removed "before they could be recorded," but Socket says Intango domains often stay active after their extensions disappear. The "Yandex search" extension was pulled after reaching 200,000 users while its domain, extension-search.online, remained live. The sources disagree slightly on current status: BleepingComputer quotes the researcher as saying most of the extensions had already been removed when the report went out, while Socket's own write up stresses that new ones keep appearing. Google had not commented by publication.

What This Means for Your Inbox

Plenty of people reach their email by typing "gmail" or "outlook login" into the address bar and clicking the first result. When that search passes through a proxy that picks a destination per request, the operator controls the first click on your way to your inbox. Tuckner warns the destination can change without an extension update, which is how a monetization scheme turns into a phishing or malware delivery channel overnight.

Search history is also personal data. Queries for a password reset page, a doctor, or a colleague's name all land in an operator's server logs. We covered a narrower version of this in the fake Perplexity extension that intercepted searches, and the same lesson from 82 Chrome extensions that legally sell browsing data applies: an extension's permissions list tells you what it can touch, but not who profits from it. That holds for anything installed on the browser where you read email, including privacy tools.

How Do You Check Whether You Are Affected?

You check by looking at which search engine Chrome is using and which extension set it. Google's Chrome Help page on default search engines covers the settings screen. Then work through this list:

• Open chrome://settings/search. If Chrome says the setting is controlled by an extension, that extension owns your searches. Note its name.
• Open chrome://extensions and turn on Developer mode. Each card now shows its ID. Search the page for odkcfoohjiicbelloepgcomekdknchjh (Predator Search) and for names like Fire Shield, Securify, WatchTower, HermesTab, or Get Weather Today.
• Remove anything you do not remember installing, plus any "search", "PDF", "manual", or "weather" add-on you no longer use.
• Run a test search and watch the address bar for detours through unfamiliar domains.
• Review site access on every remaining extension and set it to "On click" where possible.

BleepingComputer also recommends a full antivirus scan and avoiding add-ons from unknown publishers. Our roundup of anti tracking browser extensions worth trusting is a reasonable starting point for rebuilding a lean extension list.

Looking Ahead

Tuckner's position is blunt: an extension whose only function is intercepting searches users could have made anyway, hidden from indexing and sold through low value ads, "should be considered malicious by definition." Socket doubts Google feels much urgency to agree. Until the Chrome Web Store treats permissionless search overrides as a risk signal rather than a safe pattern, the audit is on you. Check your search settings today, and again every time an ad promises a free PDF converter.