Chrome Extensions Hijacking Searches Impact 13.4 Million Users
What Happened — A recent investigation by Socket uncovered 319 malicious Chrome extensions that together have 13.4 million reported installations. The extensions masquerade as utilities (PDF converters, AI search tools, etc.) but use the chrome_settings_overrides manifest key to replace the browser’s default search provider. All user queries are routed through proxy servers that append partner‑referral tags for Bing or Yahoo, generating advertising revenue for the operators. Because the extensions are unlisted on the Chrome Web Store, they are promoted via shady online ads rather than appearing in official search results. Some add‑ons consist of only a manifest and icons, requiring no permissions, background scripts, or content scripts. While the current payload is ad‑fraud, the operators can change the proxy destination at any time, potentially redirecting users to phishing sites or malicious downloads.
Why It Matters for Trust & Control Assurance — The campaign demonstrates how insufficient oversight of third‑party software on endpoints can undermine a organization’s control‑assurance posture; a robust vendor‑risk monitoring program would surface such extensions before they can affect users.
Who Is Affected — Enterprises that allow Chrome extensions on employee devices, SaaS providers, and any organization with a browser‑based workflow.
Recommended Actions — Conduct a full inventory of installed Chrome extensions, enforce a whitelist‑only policy for browser add‑ons, and deploy continuous monitoring that alerts on unauthorized changes to chrome_settings_overrides. Source: https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/
Technical Notes — Attack vector: malicious third‑party Chrome extensions leveraging the chrome_settings_overrides setting. No CVE; the threat is a supply‑chain style hijack. Potentially exposed data includes search queries, browsing habits, and any credentials entered on redirected pages. Source: https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/