Malicious Chrome Extensions Hijacked Searches for 13.4 Million Users
What Happened — Researchers from Socket identified 319 Chrome browser extensions that were marketed as PDF converters, manual‑finders, or “safe search” tools. Although listed in the official Chrome Web Store (most as unlisted listings), the extensions silently changed users’ default search settings and proxied every query through servers controlled by the extension operators before forwarding the request to Yahoo or Bing. The operators collected the search strings—often tied to a unique identifier—giving them visibility into health concerns, financial questions, workplace interests, and other personal matters. An estimated 13.4 million installations accumulated over a decade, representing a large, persistent data‑exfiltration channel. No direct evidence of downstream phishing or malware delivery was found, but the capability to redirect searches remains a risk.
Why It Matters for Trust & Control Assurance — The campaign underscores the need for strong third‑party extension governance and continuous monitoring of software that can access user data.
Who Is Affected — General internet users who install Chrome extensions; enterprises that allow employee browsers to install unvetted add‑ons.
Recommended Actions
- Enforce an enterprise‑wide allowlist for approved Chrome extensions.
- Use Chrome policies to block installation from untrusted sources and to lock default search settings.
- Periodically audit installed extensions and review permission changes through a centralized logging solution.
- Educate users on the risks of installing extensions promoted via ads.
Technical Notes
- Attack vector: malicious browser extensions (malware).
- Data exposed: search queries, potentially revealing health, financial, or personal interests.
- No CVE; the issue is a supply‑chain style abuse of a trusted platform.