A researcher at security firm Socket has found 319 Chrome extensions, with 13.4 million installs combined, that change the user's search engine and route every search through their operators' servers, BleepingComputer reports. The extensions pose as PDF converters, safe search or AI search tools and are promoted through ads on websites, without appearing in Chrome Web Store search results. The operators collect referral payments from Bing and Yahoo for the traffic they send. Most have been removed, but new ones keep appearing.

What it means: These extensions look harmless, because they request almost no permissions and many contain no code at all, since Chrome lets an extension replace the search engine with a simple setting. The real risk lies in the intermediate server: whoever controls it sees every search users make and can, at any moment and without updating the extension, send them to phishing pages or malicious downloads. Searches reveal a lot, from client and project names to health and financial topics. For businesses, the issue is practical: staff often install such tools to convert a file or find a manual, and the extension stays in the browser for years. The answer is a policy that allows only approved extensions through central management of Chrome or Edge, plus periodic checks of what is installed. Home users can check whether their search engine has changed without them remembering and remove anything they do not recognise. The fact that the extensions were hosted in Google's official store shows that being listed there is no guarantee of safety.

Read the original on BleepingComputer

Related service: Custom software

Related stories