319 Chrome Add-Ons With 13.4M Installs Tied to Search Redirect Scheme

Key points

• 319 Chrome extensions with roughly 13.4 million installations are implicated.
• Queries to Bing and Yahoo were altered and redirected.
• The campaign generated ad revenue and exposed users to tracking redirects.
• No CVE was assigned; the risk sits in extension supply chain and user trust.

An unidentified group appears to have used a large collection of Chrome add-ons to manipulate what users searched for and where those searches went. The set covers 319 extensions with approximately 13.4 million installations, according to the available facts. Instead of serving as harmless browser helpers, these extensions altered search activity and pushed queries toward monetized destinations.

The affected surface spans Google's Chrome browser, Microsoft's Bing search, and Yahoo search. Users who installed one of the add-ons may have had their searches silently changed, with queries redirected through tracking paths before landing on a search result page. That redirection created advertising income for the campaign operators while obscuring the normal search flow.

The absence of a CVE does not make the activity low-risk. This is not a software vulnerability with a patch identifier; it is an abuse of the extension distribution model and user trust. For schools and government offices, the concern is that ordinary-looking browser add-ons can become a channel for ad fraud, unwanted tracking, and loss of visibility into what employees and students are actually searching for.

IT teams should treat this as a browser hygiene and supply-chain issue. The priority is to inventory Chrome extensions across managed devices, identify any of the 319 implicated add-ons, remove them, and review whether search settings or default providers were changed. Watch for unexplained redirects, unusual search provider changes, and extension permissions that allow broad access to browsing activity.

What to do now

1. Inventory all Chrome extensions installed across managed endpoints and compare against the reported list of 319 implicated add-ons.
2. Remove confirmed or suspected extensions immediately and reset affected browsers to a known-good configuration.
3. Check and restore default search providers in Chrome, Bing, and Yahoo settings where tampering is found.
4. Block known extension IDs and redirect domains at the endpoint or network layer where feasible.
5. Review extension permissions and restrict or disallow broad browsing-activity access for non-approved add-ons.
6. Monitor for recurring search redirects and unexplained ad-related traffic from user devices.
7. Communicate to staff and students that browser add-ons should be installed only from approved sources.

Original source

BleepingComputer