Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud
Severity: medium · Patch status: no-fix-needed · Since 2026-10-29
Socket researchers identified 319 Chrome browser extensions, installed by roughly 13.4 million users, whose sole purpose is to hijack the browser's default search engine. Using only the chromesettingsoverrides manifest key, the extensions route all search queries through operator-controlled proxy servers, capture complete search histories tied to unique identifiers, and collect referral payments from Yahoo and Bing syndication programs (hspart/hsimp and PC/PTAG partner IDs). The extensions are deliberately hidden from Chrome Web Store indexing and promoted via paid advertising, with new domains and lures appearing quickly after takedowns; the technique has run continuously for about a decade. Because the operator controls per-request redirects, searches could selectively be sent to phishing or malware pages. No CVE applies; mitigation is removal of the extensions and blocking associated domains.
What to do
- Audit managed and user browsers for extensions matching search-hijacker names/brands and remove them
- Reset default search provider settings and clear associated identifiers
- Block known hijacker search/proxy domains at the network perimeter
- Restrict Chrome Web Store extension installs via enterprise allowlists
- Monitor for extensions requesting chrome_settings_overrides search-provider changes
Sources
All live incidents on Threat Watch
