A recent report issued by security researcher John Tuckner from Socket revealed a large-scale search hijacking campaign involving 319 Google Chrome extensions, with a total of 13.4 million downloads. These extensions exploit browser permissions to redirect user queries through proxy servers, aiming to generate advertising revenue through search engines such as Bing and Yahoo.
Hijacking Mechanism
These extensions rely on exploiting the chrome_settings_overrides setting in the Chrome browser, which allows them to replace the user's default search engine without the need for complex programming. In many cases, the extensions do not contain any background scripts or complex content, but rather suffice with a manifest file and icons, making it easier to pass them through the Chrome Web Store.
These extensions disguise themselves as useful tools such as PDF file converters, manual search tools, or secure search and artificial intelligence extensions. Although hosted on the official Google store, they are often unlisted, meaning they do not appear in search results within the store, and are instead promoted via misleading advertisements on external websites.
Why This News Matters
The danger of these extensions goes beyond mere ad fraud. Researchers warn that the operators of this network have the ability to change the redirection destination at any moment without needing to update the extension itself. This means users could suddenly be redirected to phishing sites or pages containing malware, turning these extensions from unwanted software into direct security threat tools.
A technical analysis of an extension called "Predator Search" showed that the exact same search operation may lead to different results each time, as the user is routed through a series of intermediate domains before reaching the final search engine, confirming the operators' complete control over the data path.
What Users Should Do
Although Google removed most of these extensions upon discovery, the threat remains ongoing due to the continuous emergence of new extensions. Experts recommend the following steps:
- Uninstall any unknown or suspicious extensions immediately.
- Perform a full system scan using a trusted antivirus program.
- Avoid downloading extensions from untrusted sources or via pop-up ads on websites.