319 Chrome extensions linked to search redirection, affecting about 13.4 million installs

Security firm Socket has identified 319 Chrome extensions tied to search redirection, which together have accumulated roughly 13.4 million installs over nearly a decade. The extensions use the chrome_settings_overrides manifest key to change users' default search engine without requesting broad permissions such as reading pages or browsing history. Searches are routed through an operator-controlled intermediate server before reaching Bing or Yahoo, typically with tracking parameters added. The same redirect path could in principle lead to phishing pages, but that has not been confirmed for these extensions. Separately, Microsoft documented a single malicious extension impersonating Perplexity that forwarded address-bar queries to an attacker's domain before redirecting to a legitimate search engine.