319 Chrome extensions and a search-redirect trick: what the reports actually say

Two separate reports about browser extensions hijacking searches came out close together, and they're easy to blur into one story. They shouldn't be.

Socket's findings (a group of extensions)

• 319 Chrome extensions linked to search redirection, with roughly 13.4 million cumulative installs over almost a decade (cumulative installs are not unique users).
• The trick is the chrome_settings_overrides manifest key: the extension swaps the default search engine without asking for broad permissions to read pages or history.
• Queries go through an operator-controlled intermediate server before landing on Bing or Yahoo, mostly with tracking parameters added. The same hop could send people to phishing pages, but that hasn't been confirmed for these extensions.

Microsoft's case (one extension)

• A single malicious Chromium extension impersonating Perplexity, using Manifest V3 declarativeNetRequest rules to send address-bar queries (and even live suggestions, character by character) to the attacker's domain before redirecting to a real search engine.
• Those DNR and domain details belong to that one extension, not to Socket's 319.

Quick check for your own browser: open your search engine settings and look at which extension, if any, says it controls them.

Full write-up with the details of both cases: Tadna