319 Chrome Extensions Hijack Search Queries in Campaign Affecting 13.4 Million Users
Extensions redirect searches through tracking servers to generate ad revenue from Bing and Yahoo
Key Takeaways
- 319 Chrome extensions with 13.4 million combined reported installations were involved in a search-hijacking campaign.
- Affected extensions redirected users' search queries through tracking servers to generate ad revenue from Bing and Yahoo.
- Google has likely removed the implicated extensions from the Chrome Web Store.
- Users should review installed extensions, remove suspicious ones, and keep Chrome and extensions updated automatically.
Quick answers
- What happened?
- A search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' search queries through tracking servers to generate advertising revenue from Bing and Yahoo. Google has likely removed the extensions from the Chrome Web Store.
- Which products are affected?
- Google Chrome
- What should defenders do?
- Users should review their Chrome extensions, remove any that are suspicious or unfamiliar, and ensure Chrome and extensions are set to update automatically. Google's removal of the extensions from the Web Store provides a baseline mitigation, but users must actively clean their browsers.
According to a report by BleepingComputer, a massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations was uncovered. The affected extensions redirected users' search queries through tracking servers, generating advertising revenue from Bing and Yahoo. The report indicates that Google has likely removed the extensions from the Chrome Web Store. Users are advised to review their installed extensions and remove any suspicious ones, while enabling automatic updates for Chrome and extensions to ensure protection against similar threats. The exact number of active installations versus reported installs may vary, and full details of specific extension names and malicious code behavior were not provided in the initial report.
Security Details
The extensions contained malicious code that intercepted search queries and routed them through tracking servers, generating fraudulent advertising revenue. The specific exploitation mechanism and extension names were not detailed in the initial report.
Affected products
Google Chrome
Mitigation
Users should review their Chrome extensions, remove any that are suspicious or unfamiliar, and ensure Chrome and extensions are set to update automatically. Google's removal of the extensions from the Web Store provides a baseline mitigation, but users must actively clean their browsers.
Sources
BleepingComputer
Chrome extensions with 13.4 million installs caught hijacking searches
Oct 29, 2026 · 16:10
Original link
Related Security News
Fake AI Desktop Apps Deploy Crypto Miners via Signed Executables
Threat actors have been distributing malicious loaders and cryptocurrency miners disguised as legitimate desktop applications for OpenAI ChatGPT and Anthropic Claude. The campaign, attributed to 'Yoba', involves creating fake GitHub projects mimicking AI tools such as GPT-5.6 Sol and Claude Opus. These counterfeit applications abuse signed executables to bypass security controls and deploy mining malware onto victim systems.
