Socket found 319 Chrome extensions with roughly 13.4M reported installs over a decade. They changed default search engines and sent queries through operator-run proxies before Bing or Yahoo.
For admins: some requested no special permissions. Check installed extension IDs, search-provider settings, and browser extension policies. Researchers did not confirm phishing or malware redirects.
www.socket.devSearchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.