319 Chrome extensions with 13.4 million installs tied to default search engine hijacking

What happened

Two browser-extension security stories surfaced close together, and a dev.to write-up argues they are being wrongly blurred into one. The first, from security firm Socket, links 319 Chrome extensions to search hijacking, with roughly 13.4 million cumulative installs spread across nearly a decade. The second, from Microsoft, concerns a single malicious Chromium extension impersonating Perplexity. The technical details differ in ways that matter, and mixing them muddles both reports.

The scale of Socket's findings

According to the dev.to summary, Socket tied 319 Chrome extensions to search redirection behaviour, with cumulative installs of around 13.4 million over almost ten years. That number counts installs rather than unique users, so it should not be read as 13.4 million affected people. Extensions get installed, removed and reinstalled, and some of the campaign stretches back years, meaning many of those installs are likely historical rather than active today.

How the hijack works

The technique at the centre of Socket's findings is a manifest key called chrome_settings_overrides. According to the write-up, an extension using this key can swap the browser's default search engine without requesting broad permissions such as reading page contents or browsing history. That makes the change look unremarkable in a permission review, because nothing about the requested access signals interception of web traffic.

Once the default engine is swapped, search queries are routed through an intermediate server controlled by the operators before landing on Bing or Yahoo, mostly with tracking parameters appended. The dev.to write-up notes that this intermediate hop could in principle be used to send people to phishing pages instead, but says that has not been confirmed for these particular extensions.

The separate Microsoft case

Microsoft's report describes something different: a single malicious Chromium extension posing as Perplexity. Rather than changing the default search engine, it uses Manifest V3's declarativeNetRequest rules to forward address-bar queries to an attacker-controlled domain before redirecting to a real search engine. The write-up says live search suggestions were also captured as they were typed, character by character.

The dev.to piece stresses a point that is easy to lose in coverage of the two stories: the declarativeNetRequest technique and domain details belong only to this one Perplexity-impostor extension, and should not be attributed to the 319 extensions in Socket's report.

A quick self-check

The write-up offers a simple way to see if you are affected: open your browser's search engine settings and check which extension, if any, is listed as controlling them. An extension name next to the default search engine setting is the visible footprint of the technique Socket describes.

Why it matters

The campaign matters for three reasons. First, the attack surface is cheap: changing a default search engine requires no alarming permission prompts, so the usual signals users rely on to spot suspicious extensions are absent. Second, the operator-controlled intermediate server is a standing interception point for search traffic. Tracking parameters are the confirmed impact, but the same hop could be repurposed for phishing, and users would have little way to notice. Third, the scale and duration suggest a durable, repeatable distribution model rather than a one-off bad actor, which is a challenge for Chrome's extension review process.

The Microsoft case adds a separate warning: declarativeNetRequest, part of the Manifest V3 permission model, was turned to exfiltrating queries and keystroke-level suggestions from the address bar. Finally, the write-up itself is a small lesson in reporting hygiene: two similar-looking incidents published close together can merge in the retelling, and precise attribution of techniques to the right campaign is what keeps the record straight.