Searchjacked: When browser extensions reroute search queries

Someone installs a PDF helper. Their searches then pass through another provider. The new Searchjacked report shows why approving a browser extension can also mean approving a data route.

Socket's report of 29 October 2026 identifies 319 extensions with approximately 13.4 million reported users or installations across research spanning back to 2016. This is not a count of people newly affected in October, nor proof of that many compromised devices.

Sources checked on 30 October 2026. We reviewed the research and Google's documentation; we did not independently investigate the extensions.

What the extensions change

According to the report, extensions replace the default search provider and send queries through an operator-controlled intermediary before Bing or Yahoo. Offers include PDF features, manuals and AI search. Socket describes referral monetization as the purpose of the redirection.

Many investigated listings were unlisted in the official Chrome Web Store and promoted through advertising. An unlisted publication alone does not prove abuse. However, official-store distribution does not replace an assessment of actual behavior.

One Socket example needs only a manifest and icons to change search settings. An intermediary can also serve changing destinations. Further harmful redirects are therefore a risk; this does not establish that every reported user received malware.

A small amount of code can open a meaningful data route

Google documents changing the search provider through chrome_settings_overrides. The extension's settings specify the search destination. An assessment focused exclusively on extensive program code or conspicuous additional permissions can therefore miss the issue.

For an organization, the next question is practical: what do employees enter into the address bar? Alongside public queries, this could include internal project names, error messages or business partners' names. These are possible examples, not contents of individual searches confirmed by Socket.

The final search result can look familiar even though another service received the request first. The visible search engine and the complete data route are different things.

What organizations can check now

Start with the extensions actually installed and compare them with approved tools. Names alone are insufficient; record the extension ID, publisher, purpose and intended search provider.

Google describes allow and block policies for managed browsers, including a request workflow for needed extensions. First check management coverage and affected working practices. An untested global block could also disrupt necessary tools.

An unexpected redirect warrants investigation, not an automatic verdict

When an extension is found, the responsible IT team and, where appropriate, privacy staff should establish which extension was active, when, and what is known about the data route. Preserve available findings before remediation makes the sequence harder to reconstruct.

A changed search provider proves neither password theft nor a complete account takeover. Conversely, familiar-looking results do not make an additional recipient irrelevant. Whether a reportable incident occurred depends on the actual data and circumstances.

Connect approval with operational checks

The organizational gap often lies between approval and operation: a browser rule exists, but nobody reconciles it with installed extensions or follows up exceptions.

In Kopexa, you can connect tool-use requirements with measures, owners and review evidence. Workforce Hub helps communicate the associated policy to employees. Technical inventory and browser configuration remain in the relevant administration systems.