# Unlisted Chrome extensions with 13M+ installs are hijacking search queries

> **Open Intelligence Dossier** · First detected: 2026-10-30 01:40 UTC · Category: Technology

## Executive Summary
Unlisted Chrome extensions with over thirteen million installs are actively hijacking default search engine settings.

## Intelligence Brief
Recent reporting outlines a major security concern involving unlisted browser extensions that are altering user search queries and modifying default search settings. Coverage details that these extensions, while appearing to barely perform any meaningful function, have managed to accumulate substantial distribution across user bases. Specifically, outlets indicate that the campaign affects millions of users through add-ons operating inside the Google Chrome ecosystem. The mechanics of the hijacking involve altering search configurations without requiring sensitive permissions from the user, allowing the underlying tracking and redirection campaigns to operate quietly in the background while users attempt normal web navigation. Multiple publications have documented the scale and technical specifics of the campaign, identifying hundreds of suspicious add-ons. According to findings covered by CyberInsider, Microsoft identified two hundred fifty browser extensions linked to a broader tracking campaign.


Concurrently, GBHackers News reported that three hundred nineteen suspicious Chrome extensions are responsible for hijacking default search settings without triggering sensitive permission alerts. Further analysis from Digital Trends emphasizes the deceptive nature of these utilities, noting that the extensions barely do anything functional while manipulating search engines. BleepingComputer and Cybernews both highlight that the affected software accounts for over thirteen million installations collectively, establishing the massive footprint of this unauthorized search manipulation. The context surrounding these reports highlights ongoing vulnerabilities within browser extension marketplaces and the distribution of unlisted or poorly vetted add-ons. Software that evades standard visibility or operates outside mainstream storefront scrutiny often presents heightened risks for end users. The ability of these tools to redirect queries without requesting elevated privileges demonstrates a significant gap in how browser environments govern basic operational settings.


Coverage does not yet specify the exact identities of all affected developers or the precise monetization methods behind the redirection schemes, leaving open questions about the economic drivers of the tracking infrastructure. As this story develops, observers and users will need to monitor further technical analyses and platform responses regarding the removal or mitigation of the identified extensions. Coverage does not yet specify what direct remediation steps Google or Microsoft will enforce to purge the malicious tools from affected systems, nor does it provide a timeline for complete resolution. Future updates from the reporting outlets are expected to track whether additional unlisted extensions share the same infrastructure or if the total installation figures will rise as investigations continue.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| CyberInsider | Microsoft finds 250 browser extensions linked to tracking campaign | [Source Link](https://news.google.com/rss/articles/CBMibEFVX3lxTE9zYVgyc1d0S3FYaGU5WnZMc1BBOHZGYUFEQ2xzLWxlQ0tEOVdoQzlCT21fQmM5U0hkZTNrMGdrNkpvQkVDYkZIbUpEOFhXb3RXQWZUcG9wSXNLd3ZlVl9jMGxidmkxNFNRNnIxUw?oc=5) |
| GBHackers News | 319 Suspicious Chrome Extensions Hijack Default Search Settings Without Sensitive Permissions | [Source Link](https://news.google.com/rss/articles/CBMiX0FVX3lxTE5CcTBLdkNVbFZLSWhRRHVsaEJpT2lpYmJfaWJaWDJTMUJZTlhERG9QNmtaN3BYcmJ5c1ZlVHRNN3JkTlFSOHhrb0JtNldjeHBudENUeGsxeXQ4ZnBZTGVN0gFkQVVfeXFMTXpnb3VlWFBFZDhUZE0zRmhYbGhibGxGZGd5R2dEVFc2OWJoRTgzeG5aaS11NllUa25Hd2E0NXdUc2doMTRMOTdvTlRKckpqWVJFV0tTTUhwbTRiaWZmVWJIQl95Yg?oc=5) |
| Digital Trends | Your search engine could be hijacked by a Chrome extension that barely does anything | [Source Link](https://news.google.com/rss/articles/CBMiwwFBVV95cUxObnpjTC1TREgyYWRIY1JaYmQzbUZJQmVEekl1NkJYUUF2MWtuNlltak52T0xvclVSOEN4UDhrT0VJZjJZdmQ3Q0hjVGE3WUZUQkljUE5NM2xsWUdfQWxudDdWY2VBN3dNbWo2ODRMalhxamI1eWJFckJXX0FnUmtpT28tSzBsYncyZE9wcEVHUFJ5cFRBRHZIdkE3T3ZRek5WRVVGOVpCR0tkWlZHT21wYzRvOFNYYnBkNzBvbDVGN3AwUDQ?oc=5) |
| BleepingComputer | Chrome extensions with 13.4 million installs caught hijacking searches | [Source Link](https://news.google.com/rss/articles/CBMiuAFBVV95cUxNdjAxYWxocDVvNzdVV1NnV1p5enB1LVBMenJMeklMUHh6NUo3SXhsT2dUXzluOHFGeWZDeEpmaHIzeUUtclhQMmtuS1JNQzhTWGxseGdkbDlHdlc4ZUs0RmZpQzdqQnN5RDEzTW1GNWh0bXpEb09mczlnMjZUZXJDLWp3ZXdIOXp1bXNIaGNsQUhqVnRHZWJ1RWptVzhRUGMwalotSmZkSEx5NzJwUmNHVWdocjVNbTQt?oc=5) |
| Cybernews | Unlisted Chrome extensions with 13M+ installs are hijacking search queries | [Source Link](https://news.google.com/rss/articles/CBMinAFBVV95cUxNWWN5ZE9fVGd5eks5ZUdWSnJ2X29tZWNBTGdrdWdNenZ0VThYczZBRUtOT1NmUkloZzdCRUlsbXFUTE5UdXk1LVNfbUQ2d09PaWk5bmN1dmlNNXlEdkg5YVVuLUhCWFRaUEFka1JLSm40Wm9mM1VZTzRhQ01ueks3WHYzUFFZOGEtTEpkc085bUNiVGI2cmYwZXZZcmM?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-10-30/unlisted-chrome-extensions-with-13m-installs-are-hijacking-search-queries*