John Tuckner’s Searchjacked investigation identifies 319 browser extensions that redirect searches through operators’ servers to collect search-ad referral payments. Socket reports roughly 13.4 million installations across a decade, including extensions already removed from the Chrome Web Store.

Evidence status: researcher-observed search redirection and analysis of extension manifests, advertising and shared infrastructure. The historical installation total does not measure unique people, currently active installations or computers compromised through code execution.

Bill Toulas’s October 29 reporting describes the same findings. Socket’s original report makes the decade-long scope particularly important: this is a newly expanded investigation of a continuing practice.

A quiet settings change can expose searches

The extensions use labels such as PDF converter, manual finder, safe search and AI search. Many are unlisted, meaning their store pages exist but do not appear in normal store searches. Advertisements lead users directly to them.

One analyzed extension consists of a manifest, the file declaring its settings, and icons. It requests no permissions and contains no background or page-injected scripts. Chrome’s built-in chrome_settings_overrides capability changes the default search provider instead.

Socket says installation still triggers a search-provider change prompt. The problem is what the new provider does: queries pass through an operator-controlled server before reaching Yahoo or Bing. That intermediary can see the search terms, and the report says queries are often associated with a unique identifier.

A short permissions list therefore cannot establish that an extension leaves searches private. The search destination itself is part of the trust decision.

Observed redirects and possible malicious destinations are different claims

Socket reports six identical searches through Predator Search producing four different routes or outcomes. These included Yahoo with referral tags, additional intermediary sites and an error page. The extension stayed unchanged while its server chose the destination.

That demonstrates server-controlled routing. Socket explicitly calls future phishing or malware redirection an assumption, rather than an observed outcome of those tests. The evidence supports unwanted search interception without turning every installation into a malware-infection claim.

The report also describes some extension clusters requesting broader permissions. The minimal manifest example does not establish identical capabilities across all 319 extensions.

Remove the extension and review the search provider

For someone checking an affected browser:

  1. Review installed extensions, including unfamiliar search, PDF and manual-finder tools. Compare suspected entries against Socket’s report and its identifiers where available; friendly names alone can be ambiguous.
  2. Remove unwanted extensions, rather than merely hiding their toolbar icons. Google’s extension-management instructions distinguish Remove from Unpin.
  3. Review the default search engine and search shortcuts. Google’s search-settings guide documents both controls. Check the configured search URL, not just a provider’s familiar display name.
  4. For a managed browser, involve its administrator. An organization may control the search provider or installed extensions. Review that policy before assuming an individual setting change will persist.

These are removal and configuration checks, not a patch-version problem. Updating Chrome alone does not remove a deliberately installed search-provider override. Removing an extension also cannot recall queries already sent to its operator.

Caveat: Socket sells security products, and its installation totals and operator groupings are research claims. BleepingComputer reported that Google had not responded by publication.