Chrome Extensions Secretly Redirect Search Queries

The security company Socket has identified numerous Chrome extensions in a recent investigation that secretly redirect users' search queries. These extensions claim to offer useful features such as PDF converters or security programs, but their actual goal is to change the browser's default search engine and route queries through servers controlled by the operators. Researchers found that many of these extensions were distributed via ads on various websites and some have millions of installations. Notably, the providers "SecuryBrowse" have nearly 5 million installations and "Free Planet VPN S.R.L" has 2 million users. These extensions were also found in the official Chrome Web Store, but were hidden in the regular search results.

The functionality of these extensions is straightforward, as they utilize Chrome's built-in capability to change the default search engine. According to Socket, they require minimal programming code to operate. This makes it easy for the operators to gain control over users' search queries and redirect them to sites like Bing or Yahoo, allowing them to profit financially. Another risk is that the operators can not only view the search queries but also control where users are redirected. This technique could potentially be exploited for phishing attacks by directing users to fake websites or harmful downloads.

However, Socket has not confirmed that these extensions have already been used for such attacks. Most of the identified extensions are said to have already been removed from the Chrome Web Store. Nevertheless, new variants continue to emerge, increasing the need for users to regularly check their installed extensions. Socket recommends uninstalling suspicious or unnecessary extensions, including those that are no longer found in the official store. Socket has published a list of 319 identified extensions that are considered dubious.

Users should pay particular attention to the source of their installed extensions. Researchers advise removing all extensions that cannot be clearly attributed or come from untrustworthy providers. The security situation is exacerbated by the fact that many of these extensions are advertised through common advertising platforms. Users often cannot recognize the actual functionality of the extensions, leading to increased susceptibility to such attacks. Researchers emphasize that proactive checking of installed extensions is essential to ensure user security.

The discovery of these dubious extensions raises questions about the responsibility of platforms like the Chrome Web Store. It remains unclear how many other harmful extensions may still be in circulation. Socket has urged users to remain vigilant and regularly check their installed extensions. Security research shows that the threat posed by such extensions should not be underestimated. Users should be aware of the risks and take appropriate measures to protect their online security.

Socket has published the list of identified extensions, which is available on their website. The list includes extensions that were previously considered safe but are now classified as potentially harmful. Users should therefore regularly inform themselves about current security warnings and adjust their browser extensions accordingly. The security vulnerability affects not only individual users but could also endanger companies and organizations that rely on the integrity of their data. Socket has emphasized that reviewing extensions is an important step in ensuring data security.

Researchers from Socket have urged users to promptly check their installed extensions and uninstall any suspicious or unnecessary ones. The list of 319 identified extensions is available on Socket's website. The security situation continues to be monitored, and new variants of these harmful extensions are expected to emerge. Users should therefore remain vigilant and regularly check their browser settings. Socket has warned users that the threat posed by such extensions should be taken seriously.

Researchers recommend uninstalling all extensions that do not come from trusted sources or are no longer available in the official store. Socket's security research has found that most of the identified extensions have already been removed from the Chrome Web Store, but new variants continue to appear. Researchers have published a list of all 319 identified extensions, which is available on their website. The largest providers on this list are "SecuryBrowse" with nearly 5 million installations and "Free Planet VPN S.R.L" with two million users.