Socket researcher John Tuckner has documented 319 Chrome extensions with a combined 13.4 million reported installations that quietly replace the browser's search provider and route every query through an operator-controlled proxy. The extensions exist to collect referral payments from Bing and Yahoo, and the same proxy can be repointed at phishing pages later.

What happened

The report expands Tuckner's April 2025 finding of 57 extensions with 6 million users by another 264 add-ons and 8.7 million users. All of them appear to come from a small number of organised operators working the same model: take over the default search engine, send the query through a proxy, and collect syndication partner revenue.

The extensions present themselves as PDF converters, search helpers, "safe search" tools and AI search assistants. Most are unlisted on the Chrome Web Store, so they do not appear in store search, and users arrive through adverts on unrelated websites instead.

Little code is needed. Chrome's chrome_settings_overrides setting lets the extension replace the search provider outright, and one sample analysed in the report contains only a manifest and icons with no scripts or requested permissions.

The revenue model is not the whole risk. Because the proxy operator chooses the destination, the same unscanned extension can start sending users to malicious search results, phishing pages or malware downloads without any update being pushed. One sample, Predator Search, sent six identical searches to four different destinations.

Who is affected

• Chrome users who installed a PDF converter, search enhancer or "safe search" extension from an advert rather than from a store listing.
• Organisations that let staff install browser extensions without an allowlist, so the extension inherits the user's mailbox, file and SaaS sessions.
• Shared and kiosk machines where one infected profile keeps redirecting for every shift that uses it.

What to do now

Inventory and remove unknown extensions from managed browsers, then block the install path. Redirected search is a symptom, not the limit of the damage.

• Pull the installed extension list from Chrome across the fleet and compare it to a written allowlist.
• Remove anything that overrides the search provider or arrived through an advert, and reset the browser profile afterwards.
• Enforce extension allowlisting through Google Admin console, Edge policy or your RMM, so users cannot add unlisted add-ons.
• Check search settings on affected machines for an unfamiliar default provider, and check for new toolbars or home page changes.

What this means for South African businesses

Very few SMEs can name the browser extensions running on their own machines, which is why this campaign reached 13.4 million installs without a single exploit. The current payload is advertising fraud, so the damage looks like bad search results rather than an incident, and that is exactly why it survives for months.

Once an extension sits in a browser that is already signed into Microsoft 365, the same channel becomes a route to credential phishing, and an unlisted add-on is a supply chain you never assessed.

Source: BleepingComputer, reporting Socket's research published 29 October 2026.

Also on the blog

• FNB fined R1 million after one access-control slip exposed 88 home loan files to 696 clients
• Linux kernel CVE-2026-98432: 9.8 remote root flaw with no Ubuntu or RHEL patch

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.