319 Chrome Extensions Route Searches Through Operator Proxies

Socket identified 264 more search-hijacking Chrome extensions, bringing its investigation to 319 extensions with roughly 13.4 million users across a decade. Some look like PDF, manual or safe-search tools and are promoted through paid ads to unlisted Chrome Web Store pages. Their search-provider override can work without requested permissions, a background worker or a visible interface. Default-provider searches go to an operator proxy before Yahoo or Bing results, where the operator can see the terms and choose the redirect.

In one test, Socket sent six identical searches through Predator Search’s proxy and saw four destinations. Its extension ID is odkcfoohjiicbelloepgcomekdknchjh. Use it as one inventory pivot, then examine the configured default search URLs for other installed extensions, including those with zero requested permissions. An unlisted store page will be missed by a store-name search.

For affected managed Chrome profiles, remove the unwanted extension, block its ID with the ExtensionSettings installation policy where applicable, and restore the approved search provider. Run an ordinary search from a test profile and inspect the first request and redirect chain: the configured provider should receive the request without an operator proxy hop. On Windows, check the deployed ExtensionSettings policy in your management console and test the effective search route. Google’s chrome://policy instructions for verifying an OK status and applied value explicitly address managed ChromeOS devices. Review retained browser or proxy logs separately if you need to assess searches sent before removal.