L3 · ShartedChrome · extensions · Searchjackedsearchjacked-extensions

Searchjacked research links hundreds of browser extensions to search-query interception

Socket documents search-hijacking extensions that route queries through operator-controlled proxies. Its 319-extension, roughly 13.4-million-user tally spans a decade and is not a count of newly infected or unique victims. The new report adds 264 identified extensions.

Disclosed: Oct 29, 2026; Public disclosure date
Severity: Sharted; No CVE: a breach, not a bug
Splash zone: Browser profiles with the identified extensions installed and their search-provider overrides enabled; web
In the wild: Yes; The researcher directly tested live proxy redirection and documented installed extensions.

What happened

The newly published research adds identified operators and extensions to an older search-hijacking pattern; it does not date the whole campaign to October 29. Search overrides can send queries to an intermediate server even without conspicuous extension permissions or background code.

Socket observed server-selected destinations. Redirecting to phishing or malware is a potential consequence, not a confirmed outcome for every extension. Its aggregate user figures are researcher-reported, unverified outside that investigation, and include extensions from different years. Do not call them 13.4 million newly breached accounts. L3 reflects broad browser exposure and concrete interception behavior, without claiming an internet-wide exploit.

Crime-scene timeline

Oct 29, 2026
Socket publishes expanded identification and proxy-redirection analysis
~Apr 2025
Earlier research documents related search-hijacking extensions

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

Socket Searchjacked researchPrimaryPrimary investigation of newly identified extensions, historical totals, proxy behavior and hunting pivots.
BleepingComputer reportReports the same researcher’s findings; it is not independent confirmation of the historical user total.

Wipe guide

The wipe checklist

0 of 3 sheets used

Inventory and remove the identified extensionsThe report covers 319 extensions, but its complete machine-readable ID list was not available in the public text we could read. Inspect chrome://extensions and enterprise inventory using verified examples and request the full indicator dataset from the researcher. Predator Search has extension ID odkcfoohjiicbelloepgcomekdknchjh. Remove confirmed unwanted extensions from every synced profile and check chrome://policy for forced reinstalls; names and store visibility alone are unreliable.
Restore search settings and inspect redirectsReview default search engines and manifest chrome_settings_overrides.search_provider settings. Report examples include search.safesearchgame[.]com/query, suggest.safesearchgame[.]com/querying/autocomplete, searchlio[.]net, searchtosearch[.]com, mcftink[.]com, extension-search[.]online, newtabsearch[.]net, newtabhub[.]net, getsimplepdfsearch[.]com, *.system1[.]partners, *.s1search[.]co and axt.iadispatcher[.]com. Restore a trusted provider after removal. These domains are investigation leads, not a complete blocklist; a match alone does not prove compromise.
Assess query exposure without overstating itUse retained browser and proxy logs to establish whether sensitive queries traversed these proxies. The report does not prove blanket theft of passwords or tokens, nor confirm that all redirects delivered malware. Apply browser extension allowlists and review new install requests; do not infer that unlisted IDs are safe when the full dataset cannot be retrieved.

Searchjacked research links hundreds of browser extensions to search-query interception

What happened

Crime-scene timeline

Who said what

Other turds from around the same time