Socket's John Tuckner found 264 more extensions (8.7 million installs) on top of the 57 he reported in April 2025. They pose as PDF converters, manual finders, "safe search" and AI search tools, are unlisted in the Chrome Web Store and are pushed through web ads. Many contain only a manifest and icons: Chrome's chrome_settings_overrides manifest key is enough to replace the search provider, with no scripts or permissions.

• Monetization: every query goes through an operator server, then to Bing or Yahoo with syndication partner tags (for example hspart, hsimp, PC, PTAG parameters).
• Risk: the server picks the destination per search. In one test, six identical searches through "Predator Search" ended in four different places, including intermediate results domains. Largest clusters: "SecuryBrowse" (58 extensions, 4.9 million users; names like Fire Shield, Securify, WatchTower) and "Bing-Search" (37 extensions, 2.2 million).

Hunt: inventory extensions across managed browsers and match IDs against Socket's list; flag any extension whose manifest has chrome_settings_overrides.search_provider; in proxy logs, look for search traffic to unknown domains before bing.com/yahoo.com with partner parameters. Fix: use an extension allowlist (ExtensionInstallAllowlist) and lock the default search provider by policy.