Chrome extension search hijacking: how proxy routing works

Socket’s investigation, published October 29, 2026, described 319 Chrome extensions that changed the default search provider and routed searches through operator-controlled proxies. Socket estimated about 13.4 million historical users or installations across a decade, and said the proxies could select a destination for each search. Its findings include a specific test in which six identical searches reached four different outcomes. (Socket’s investigation)

The reported totals do not add up

Socket described 319 distinct extensions. BleepingComputer reported that earlier research covered 57 extensions and that the expanded investigation added 264. Those figures total 321, not 319.

The user estimates also differ: BleepingComputer cited 6 million users for the earlier group and 8.7 million for the additions, which total 14.7 million, not 13.4 million. Socket’s separate estimates for identified and unknown operators add to approximately 13.44 million. That rounds to 13.4 million, but does not reconcile the different component figures.

How an extension can reroute a search

An extension’s manifest is its configuration file. Socket says the chrome_settings_overrides entry in a manifest can replace Chrome’s default search provider. Its example did this without requested permissions, a background service worker or content scripts.

Socket says searches could then pass through an operator-controlled proxy before reaching a search destination. The proxy could capture queries and choose where to send each one. Socket also reported referral identifiers associated with Yahoo and Bing in these routes, which could generate referral revenue for operators.

That mechanism explains why a short permissions list alone does not tell you where a search goes. The override changes the search provider, while the proxy handles the request beyond the browser.

What Socket observed with Predator Search

In its Predator Search example, Socket reported that six identical searches reached four outcomes: Yahoo with partner tags; a landing page at searchlio.net; a route through searchtosearch.com and mcftink.com before Yahoo; and a Cloudflare error page that did not respond.

Socket said the extension itself stayed unchanged during those searches and the proxy selected each destination. This was a reported test of Predator Search, not a result Socket attributed to every extension in the investigation.

Socket’s operator estimates

Socket split its estimates between extensions linked to identified operators and those linked to unknown operators. Its user figures are approximate historical estimates.

Socket says the activity it identified dates back to 2016. It describes the SecuryBrowse cluster in 2024 as 58 extensions with about 4.9 million users, and the Bing-Search cluster as 37 extensions with about 2.21 million users. Socket also attributes about 111 extensions and 2.187 million users to Intango LTD from 2018 onward.