Unlisted Chrome extensions with 13M+ installs are hijacking search queries

Chrome users have been hit by another wave of browser extensions behaving badly. According to a Cybernews report, a cluster of unlisted Chrome extensions with more than 13.4 million installs has been hijacking search queries, routing them through proxy servers before users ever see their results. The discovery raises fresh questions about how much trust people can place in browser add-ons.

The extensions in question are described as "searchjacking" tools. Rather than simply helping users browse, they quietly intercept what people type into the address bar or search box and redirect it. Below, we walk through what the evidence shows, how the scheme appears to work, and what you can do about it.

What Searchjacking Extensions Actually Do to Users

Searchjacking is a form of browser hijacking in which an extension changes or intercepts search behavior. A user types a query expecting results from their chosen search engine, but the extension reroutes the request through a third-party server first. That server can then log the query, alter the results, or insert its own ads and affiliate links.

The change is often subtle. Results can look nearly identical to those from a legitimate engine, which makes the manipulation hard to spot. Many users would never realize their searches were taking a detour.

According to the report, the 13.4 million installs spread across the affected extensions represent a very large exposure. Even if only a fraction of those users were actively affected, the volume of redirected queries could be enormous.

How Unlisted Extensions Slip Past Typical Scrutiny

One of the most notable details is that these extensions were unlisted. Unlisted extensions do not appear in Chrome Web Store search results or category pages, but anyone with a direct link can install them. This feature exists for legitimate uses, such as internal company tools or private betas.

That same feature can be abused. Because the extensions are not discoverable through normal browsing, they may attract less public review, fewer user complaints, and less attention from security researchers.

Distribution likely happened through other channels, such as websites, bundled installers, or promotional pages pointing directly to the store listing. Users who followed those links may have believed they were installing something harmless like a utility or a PDF tool.

Routing Queries Through Proxy Servers Explained Simply

A proxy server acts as a middleman between your browser and the destination website. In a legitimate setting, proxies can improve privacy or performance. In this case, the proxies reportedly sit between the user and the search engine, giving the operators visibility and control over each query.

This arrangement allows several kinds of abuse. Operators can collect search histories, which are valuable for profiling. They can also swap in sponsored results or redirect users to partner sites, generating revenue from clicks.

Because the traffic passes through infrastructure the user cannot see, there is little indication that anything has changed. Only a close look at network requests or extension permissions would reveal the redirection.

What the Evidence Shows About the Campaign

The Cybernews findings point to a coordinated pattern rather than isolated mistakes. Multiple extensions shared similar behavior, similar code characteristics, and a common approach to redirecting queries. That suggests a single operator or group behind the network, or at least a shared toolkit.

The install count of 13.4 million is the headline figure, but it also deserves caution. Install numbers can be inflated, and they do not reveal how many users are still active. Still, the scale indicates the campaign had meaningful reach.

Researchers also noted that the extensions requested broad permissions. Access to modify web requests or read browsing data is a common trait of tools that can manipulate search traffic, and it is worth treating as a red flag.

Privacy Risks That Go Beyond Search Results

The immediate concern is manipulated search results, but the privacy implications run deeper. Search queries often reveal health concerns, finances, job hunting, political interests, and personal problems. Handing that data to an unknown party is a significant risk.

Collected data can be sold to brokers, used for targeted advertising, or combined with other information to build detailed profiles. In worse cases, redirected results could send users to phishing pages or sites hosting malware.

There is also the question of trust in the extension ecosystem. When an add-on can silently change how a browser behaves, a single bad update can turn a useful tool into a surveillance mechanism.

Why Chrome's Extension Review Process Struggles

Google has invested in automated and manual reviews for the Chrome Web Store, yet malicious or deceptive extensions repeatedly get through. Attackers often publish a clean version first, then push a harmful update after gaining installs. Others disguise their behavior with obfuscated code.

Unlisted status adds another layer of difficulty. With fewer eyes on these listings, problems may persist longer before being flagged. Reviewers must also distinguish between legitimate private extensions and those built for deception.

This is not the first time large extension campaigns have been exposed. Previous investigations have uncovered millions of installs tied to adware, data harvesting, and affiliate fraud, showing that the problem is systemic rather than a one-off event.

How to Check and Remove Suspicious Extensions

Start by opening chrome://extensions in your browser and reviewing everything installed. Remove any extension you do not recognize or no longer use. Pay special attention to tools that mention search, new tab pages, or productivity features without a clear publisher.

Next, check your default search engine in Chrome settings to ensure it has not been changed. Review the permissions of each remaining extension, and be wary of those that can read and change all your data on all websites.

If you suspect compromise, consider clearing browsing data, resetting Chrome settings, and changing passwords for sensitive accounts. Running a reputable security scan can also help identify related unwanted software.

Staying Safer With Browser Extensions in Future

Install as few extensions as possible, and only from publishers you can Verify. Read recent reviews, check the developer's website, and be skeptical of direct-download links that bypass normal store discovery. If an extension is not easily found in search, ask why.

Organizations should consider enforcing allowlists for extensions through managed browser policies. This limits employees to approved tools and reduces the chance of an unlisted add-on slipping into a corporate environment.

Finally, keep an eye on security news. Campaigns like this one are usually discovered by researchers, and prompt awareness lets you act before your data travels too far. The 13.4 million installs behind this case are a reminder that convenience in the browser always comes with a trade-off.

If you have any questions, please don't hesitate to Contact Us