- Socket found 319 browser extensions, installed by roughly 13.4 million users over a decade, that take over the default search engine and route queries through proxy servers to earn referral payments.
- Some contain only a settings file and ask for no permissions, so a permission review would pass them. Socket says the redirects can change search by search.
- Leaders should ask IT for an extension inventory, check default search settings on managed browsers, and limit installs to an approved list.
A browser extension can ask for no permissions, contain no working code, and still decide where every search you type goes. That is the uncomfortable finding in new research from the security firm Socket, published October 29.
Socket's researchers identified 319 extensions, installed by roughly 13.4 million users over a decade. The oldest date to 2016. Of these, 264 are newly identified in this report and account for 8.7 million more users than Socket's earlier research. Socket says a handful of organised operators sit behind them.
An extension with almost nothing in it
Every Chrome extension has a settings file, called a manifest. It includes a field that changes the default search provider. Socket points out that this is built into the extension framework and is not code that runs.
Socket says one extension it analysed was a manifest plus three icon files. Nothing else. It requests no permissions.
That matters because many reviewers treat "no permissions" as "no risk". Socket argues that this assumption is wrong. Installing such an extension does trigger a prompt about the search change. According to Socket, the prompt does not clearly say where your searches end up.
The lesson here is that risk can live in a setting, not a capability. A review that only reads permission lists will miss it.
How the money works
Yahoo and Microsoft run search syndication programmes. Partners who bring in search traffic earn a share of the ad revenue. Each partner gets tracking IDs: Yahoo uses the hspart= and hsimp= parameters, and Bing uses PC= and PTAG=.
Socket's finding is that the operators quietly take over the default search engine and collect those payments under their own partner IDs. It is a toll booth placed on a road that was already free. Results can look ordinary, so users may not notice.
The proxy decides, one search at a time
In the extensions that ship code, searches pass through a proxy server first. Socket found that most redirects only added partner tags to the results. But it also saw a repeated search land on Google's homepage without tags, while other searches kept going to Bing. So the destination is chosen per request.
Socket tested Predator Search, which has 50,000 users. It sent the same search through the extension's proxy six times. The searches did not follow one route. Some reached Yahoo with partner tags. Others went to a landing page, took a detour through extra domains first, or hit an error page from Cloudflare. The extension never changed. The proxy picked each destination.
Socket is careful here. It describes the malicious use of these redirects as an assumption, not something it observed. It also notes that the extensions could simply place the partner tags in the search setting directly, without a proxy. Its concern is that an operator could collect data, wait for targets to surface, and then send them to phishing pages or malicious downloads. The researchers did not report seeing that.
Hidden by design, spread by cheap ads
Chrome Web Store lets publishers keep an extension out of store search. Socket says a majority of the search hijackers it found use this option. A person needs the exact ID or a direct link to reach them. Socket notes there can be good reasons for unlisting, but says attackers use it to avoid discovery.
So how do 13.4 million users find them? Through paid ads, Socket says, including Google Ads and Bidbrain. The ads appear as pop-overs and pop-unders on small blogs and content farms, offering tools to "Search PDFs" or "Find Manuals". A few clicks later the extension is installed and forgotten.
Socket traced one advertiser, BrightWorks Technology LLC, through Google Ads Transparency. About 400 ads were tied to a single domain, getsimplepdfsearch.com. The advertiser had over 3,000 ads in total for extensions to download.
Socket also offers a view on incentives. More ads and more listings mean more revenue for the ad platform, so it suggests there may be no urgent reason to police this activity broadly. That is Socket's interpretation, not a finding. On popularity, Socket calculates that treating all these installs as one extension would put it among the 25 most-installed Chrome extensions today.
What to ask your team
The report does not say how many of these users are on company devices. That is a question to answer for your own organisation. Start with four.
First, can IT produce a list of every browser extension on managed devices, and who approved each one? Second, does the review check the default search provider, not only the permission list? Third, can installs be limited to an approved list, so an ad on a content farm cannot add software to a work browser? Fourth, do staff know that a free "PDF" or "manual" tool offered in an ad is not a vetted tool?
An extension that does nothing except change one setting still holds the keys to what your people search for. Review the setting, not only the permissions.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Socket.
