Security Risk from Unreliable Chrome Extensions

The security company Socket has uncovered numerous Chrome extensions in a recent investigation that are disguised as useful tools but secretly redirect search queries. These extensions, which appear as PDF converters or AI search services, boast millions of installations. Researchers found that the extensions change the browser's default search engine and route queries through servers controlled by the operators. The redirection of search queries often occurs to Bing or Yahoo, allowing the extension operators to profit from these redirects. The spread of the extensions occurs through advertisements on various websites, with many also found in the official Chrome Web Store.

However, they have been hidden in the regular search results of the store, making discovery difficult. The researchers at Socket emphasize that the identified extensions require minimal programming code to function. They exploit Chrome's built-in capability to change the default search engine, facilitating the manipulation of search queries. This technique could potentially also be misused for phishing attacks by directing users to fake websites or harmful downloads. Although the researchers could not confirm that the extensions have already been used for such attacks, the possibility remains.

Most of the identified extensions have now been removed from the Chrome Web Store, but new variants offering similar functionalities continue to emerge. Socket recommends that users check their installed browser extensions and uninstall any suspicious or unnecessary ones. The published list by Socket includes a total of 319 identified extensions. The largest providers among these are SecuryBrowse with nearly 5 million installations and Free Planet VPN S.R.L with 2 million users. Users should pay particular attention to the source of their installed extensions and remove any that belong to the identified providers or cannot be clearly attributed.

Additionally, it is advised to delete add-ons that are no longer found in the official store. The security situation is deemed critical, as the operators of the extensions can not only view the search queries but also control where they are redirected. This could pose a serious security risk for users. Socket has urged users to remain vigilant and regularly check their installed extensions. The researchers warn that the technology behind these extensions could also be misused in other contexts.

The discovery of these unreliable providers raises questions about the security and integrity of the Chrome Web Store. The security firm Socket has already taken measures to identify the affected extensions and warn users. The list of dangerous extensions is continuously updated to give users the opportunity to protect themselves from potential threats. Users should be aware that the danger from such extensions lies not only in the redirection of search queries but also in the potential to harvest personal data. The researchers at Socket have emphasized that user security is the top priority and that they will continue to work on raising awareness about such threats. Users are called upon to take their browser security seriously and regularly check their installed extensions. Socket has made a clear recommendation: "Check your installed extensions and remove any that appear suspicious or are no longer available in the official store."