---
title: Hunt: 319 unlisted Chrome extensions with about 13.4 million installs swapped the default search engine for operator proxies; the same proxy can switch to phishing at any time | ctxsec
url: https://ctxsec.com/items/hunt-socket-searchjacked-319-chrome-extensions-search-proxy
description: ""
status: "vendor research (Socket, Oct 29); most listed extensions already removed from the Chrome Web Store"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-socket-searchjacked-319-chrome-extensions-search-proxy.md)

vendor research (Socket, Oct 29); most listed extensions already removed from the Chrome Web Store

2026-10-29

### Hunt: 319 unlisted Chrome extensions with about 13.4 million installs swapped the default search engine for operator proxies; the same proxy can switch to phishing at any time

Socket's John Tuckner found 264 more extensions (8.7 million installs) on top of the 57 he reported in April 2025. They pose as PDF converters, manual finders, "safe search" and AI search tools, are unlisted in the Chrome Web Store and are pushed through web ads. Many contain only a manifest and icons: Chrome's `chrome_settings_overrides` manifest key is enough to replace the search provider, with no scripts or permissions.

- **Monetization:** every query goes through an operator server, then to Bing or Yahoo with syndication partner tags (for example `hspart`, `hsimp`, `PC`, `PTAG` parameters).
- **Risk:** the server picks the destination per search. In one test, six identical searches through "Predator Search" ended in four different places, including intermediate results domains. Largest clusters: "SecuryBrowse" (58 extensions, 4.9 million users; names like Fire Shield, Securify, WatchTower) and "Bing-Search" (37 extensions, 2.2 million).

**Hunt:** inventory extensions across managed browsers and match IDs against Socket's list; flag any extension whose manifest has `chrome_settings_overrides.search_provider`; in proxy logs, look for search traffic to unknown domains before bing.com/yahoo.com with partner parameters. **Fix:** use an extension allowlist (ExtensionInstallAllowlist) and lock the default search provider by policy.

Sources: [Socket: Searchjacked, hidden browser extensions hijack searches for 13 million users (Oct 29)](https://socket.dev/blog/searchjacked)