Chrome extensions posing as PDF converters were hijacking your web searches

Same search, six times, four different destinations. Researcher John Tuckner of security firm Socket tested the Chrome extension “Predator Search,” installed about 50,000 times. His queries ended up on Yahoo, on a page of the site searchlio.net, on a redirect chain ending on Yahoo, or on an error page. “The extension never changed; it was the intermediary server that chose each destination at search time,” he sums up.

Predator Search is just one example. In a report published on October 29, Socket lists 319 Chrome extensions that replace the user's search engine, with about 13.4 million cumulative installs over a decade. The report builds on earlier work, adding 264 extensions that total about 8.7 million users.

A PDF converter that picks your search engine

These extensions present themselves as PDF converters, tools for finding a user manual, “safe search,” or AI-powered search. Once installed, they change the default search engine. Chrome itself allows this setting: one of the extensions analyzed contains no lines of code and requests no permissions. Chrome only asks the user to confirm the change of search engine, without clearly stating where searches will go.

Searches then pass through an operator's server before reaching Bing or Yahoo, which pay the operator a commission. According to Socket, this detour also lets the operator collect the full search history, often tied to a unique identifier.

Many of these extensions don't show up in Chrome Web Store search. They are pushed through ads in pop-up windows on low-quality sites. Socket identifies several clusters. Among those with an unknown operator are “SecuryBrowse” (58 extensions, about 4.9 million users, with reassuring names such as Fire Shield) and “Bing-Search” (37 extensions, about 2.2 million). Others are linked to advertising companies, including Intango, to which the report attributes 111 extensions.

More than ad fraud

The risk goes beyond advertising commissions. Because the destination is decided on the server, the operator can change it without updating the extension. It could then send its users to a phishing page or a booby-trapped download.

According to the researcher, quoted by BleepingComputer, most of these extensions had been removed from the Chrome Web Store by the time of publication, but new ones keep appearing. Google had not responded to the outlet's questions. Socket adds that similar extensions have been seen on Edge.

Best practices

The trap relies on no vulnerability: all it takes is a click on “Add to Chrome.”

• Open chrome://extensions and remove anything you don't use, especially PDF, weather or “safe search” tools installed from an ad.
• In the settings, under “Search engine,” check that the default engine is the one you chose.
• Compare your extensions with the names and clusters described in Socket's report.
• In a company, allow only vetted extensions, using Chrome's management policies.
• Don't rely on the absence of requested permissions: here, it proves nothing.

It remains to be seen whether Google will change this Chrome setting, which extensions with no lines of code can use. Socket suggests that Google may have no urgent reason to monitor these practices too broadly, since it can benefit from the rise in ads served and extensions published.