Socket researcher John Tuckner published research on 29 October 2026 ('Searchjacked') on 319 browser extensions installed by roughly 13.4 million users over about a decade that hijack searches, capture queries and collect referral payments from Yahoo and Bing.

Socket says the work expands on previous research with 264 newly identified extensions affecting 8.7 million more users, and that the extensions were created by a handful of organised operators who quietly take over the browser's default search engine, route every query through a suspicious proxy server and collect partner referral payments from Yahoo or Bing under a syndication partner ID.

According to Socket, the extensions pose as 'manual finder', 'safe search', 'PDF converter' or 'AI search' tools, are pushed into browsers through paid advertising (Google Ads, Bidbrain and more), and a majority are unlisted in the Chrome Web Store so they do not appear in its search.

Socket says many need almost no code: one analysed extension consisted only of a manifest that changes the default search provider plus three icon files, with no permissions, background service worker or content scripts.

Socket says that because searches pass through the operator's server first, the operator sees the complete search history, often tied to a unique identifier, and decides per request where each search ends up; it saw one extension, Predator Search (about 50,000 users), send six identical searches to four different destinations.

Socket says it is only an assumption that the redirects could be malicious, but warns the operator could later serve phishing pages, fake results or malware lures selectively. Clusters it describes include a 2024 'SecuryBrowse' wave of 58 security-branded extensions with about 4.9 million users and a 'Bing-Search' group of 37 extensions with about 2.2 million users published from April 2025. (source: Socket)

BleepingComputer reports that the researcher said most of these extensions had been removed from the Chrome Web Store when the report was published, that new ones are constantly being added, and that it had contacted Google for comment without a response by publication. (source: BleepingComputer)