A browser extension that does nothing except change your search engine sounds harmless, almost boring, right? After reading this research, I’m convinced you shouldn’t ignore it.
Security firm Socket says it found over 300 Chrome extensions that quietly swap a user’s default search engine and route every search through servers controlled by the people behind them before it reaches Bing or Yahoo. Even more alarming, these extensions have reportedly racked up roughly 13.4 million installs over the past decade.
How do these extensions slip past everyone?
The trick is almost embarrassingly simple. Chrome has a built-in setting that lets an extension swap your default search engine without running a single line of code. One example analyzed by researcher John Tuckner used only a settings file and three icons, and requested no permissions.
The immediate goal is to earn referral payments from those two search engines. However, Tuckner warns that the same setup could be turned against you.
The extensions dress up as handy tools, such as PDF converters, manual finders, “safe search” helpers, and AI search add-ons. Most are distributed outside the Chrome Web Store, meaning you won’t find them through a normal store search.
Instead, they reach users through spammy pop-up ads on smaller websites. Most had already been removed from the store by the time the report was published, but new ones kept surfacing.
It’s easy to see why users might let these extensions through. Chrome does show a prompt during installation, but that doesn’t necessarily make the consequences of changing your search engine obvious.
Why does it matter if they only want ad money?
Because every search you type passes through the operator’s server first, the people behind these extensions can see your search history, often linked to a unique identifier.
In one test, six identical searches through the Predator Search extension ended up in four different places, even though the extension itself remained unchanged.
Most searches currently end at Yahoo or Bing. However, the same system could potentially redirect specific searches to phishing pages or malware downloads. Tuckner acknowledges that this is a potential risk, not evidence that such redirects are already happening.
So, what should you do? Open chrome://extensions and remove anything you don’t recognize, especially search, safe-search, or PDF tools. Then head to Settings > Search engine and make sure your default is the one you chose.
RELATED COVERAGE: