319 Chrome extensions quietly decided where your searches went

Type something into the address bar and you assume it goes to your search engine. For roughly 13.4 million people, it took a detour first. Socket researcher John Tuckner published his findings on 29 October: 319 Chrome extensions, accumulated over about a decade, all doing the same thing. It expands work he started in April 2025, when the count was 57 extensions and six million users.

The mechanism is almost boring. Chrome lets an extension declare a replacement search provider, and these extensions do little else. Your query goes to a server the operator controls, which forwards it to Bing or Yahoo and collects a referral payment. The biggest clusters are a wave Socket calls SecuryBrowse, 58 extensions and about 4.9 million users, and a Bing-Search group of 37 extensions with 2.2 million. They present themselves as PDF converters, appliance manual finders, safe search tools, AI search helpers.

Being paid for your searches is the mild version. The operator sees every query you type, usually tied to an identifier that follows you, and can change the destination whenever it suits without touching the extension itself. Tuckner ran six identical searches through one of them and landed in four different places. Most of these were unlisted in the Chrome Web Store, so nobody found them by browsing; they arrived through adverts. Google had pulled most by the time the report went out, and more keep appearing.

Open chrome://extensions, read the list properly, and remove anything you cannot account for. Then check Settings, Search engine, and set it back yourself. Tendvane's "browser hijacked" repair wizard walks through the same ground if the search engine will not stay put after you change it.