319 fake Chrome extensions secretly read 13.4 million people's searches

What happened

At the end of October, researchers at the security company Socket published details of 319 Google Chrome extensions that had been installed an estimated 13.4 million times over about a decade. The extensions promised simple, useful things: converting PDFs, finding manuals, "safe search" or "AI search". Many were advertised through online ad networks, including Google Ads.

Behind the scenes, they changed the browser's default search engine. Every time someone typed a search, it went first to a server run by the extension's makers and only then on to Yahoo or Bing, so the results still looked normal. The makers could read the searches and earn money from referral deals with the search engines.

Why it matters

Your searches say a lot about you: health worries, money problems, travel plans, where you live. Socket said the searches were often tagged with a unique ID, which means the operators could link one person's searches together over time and build a picture of them.

There was a bigger risk too. Because the operators controlled where each search went, they could have quietly sent people to fake login pages or to malware downloads. Socket said it found no evidence that this happened, but the ability was there.

Most of the extensions were "unlisted" in the Chrome Web Store. That means you would not find them by searching the store: people reached them through adverts and direct links, which made them harder for anyone to notice.

What it means for you

Browser extensions can see a great deal of what you do online, so treat each one like an app you are letting into your house. A free tool that only converts a PDF does not need to control your search engine. If an extension asks for more than its job needs, that is a warning sign. Our guide to browsers and cookies explains what your browser shares, and keeping your devices updated covers the other half of staying safe.

Check your browser in two minutes

1. In Chrome, type chrome://extensions in the address bar and press Enter.
2. Remove anything you do not recognise, no longer use, or installed only for one quick job.
3. Open Settings > Search engine. If Chrome says an extension is controlling this setting, remove that extension unless you chose it on purpose.
4. Run a scan with your security software to look for anything else unwanted.
5. In future, use the converters and tools built into your computer or a trusted website instead of installing a new extension for every small task.