Chrome Search Changed? Check Your Extensions First

Open Chrome's extension manager if searches from the address bar have started passing through unfamiliar sites, or if a PDF, manual-finding or safe-search add-on changed your default search engine. A Bing or Yahoo results page alone is not evidence of a problem; the question is whether an extension inserted an unexpected intermediary.

In its 29 October Searchjacked report, Socket documents extensions that route searches through operator-controlled servers before sending them to a search provider with advertising referral tags. The new investigation expands earlier research. Its headline total spans a decade, so it should not be read as a count of current victims or a new breach affecting every Chrome user.

Socket analysed an example consisting of a manifest and icons, without background scripts, content scripts or requested permissions. Chrome's search-provider override was enough to redirect address-bar searches. The report says installation does prompt about changing the search provider, but does not clearly explain where queries will end up.

That intermediary can see the query sent to it. Socket says searches are often tied to a unique identifier. The privacy issue is therefore not just which results page eventually appears: a separate operator has received the words you searched for.

The researcher also observed an unchanged extension producing different destinations for repeated searches. Socket warns that server-controlled redirects could be used for phishing or malware lures, but explicitly treats malicious redirection as a possibility. The report does not establish that every listed extension delivered malware.

Type chrome://extensions into Chrome's address bar yourself. Review unfamiliar add-ons and compare their exact extension IDs with Socket's report; Developer mode in the extension manager exposes those IDs. Do not install a supposed clean-up extension from an advert to investigate another extension.

Remove unwanted add-ons, then open Settings > Search engine and restore the provider you actually want. Test a harmless query from the address bar. If an extension or policy still controls the setting on a work-managed browser, ask IT rather than trying to bypass the policy.

Review every Chrome profile you use, keep the browser updated and run your trusted security software if you downloaded something suspicious. If you entered credentials on an unexpected sign-in page, secure that account through its official site from a trusted device; removing an extension alone does not revoke a stolen session. These are precautionary next steps, not a claim that Socket confirmed account theft in every case.

A VPN can protect the network path to its server and change the public IP address seen by a destination. It cannot conceal a search query from an intermediary that the browser deliberately sends that query to. Nor does it remove an extension or restore Chrome's search settings.

Deal with the browser configuration first. A familiar store listing, a security-sounding name or a short permission list is not enough to establish that an add-on is useful or trustworthy. Keep only extensions whose purpose and publisher you can explain.