319 extensions, 13.4 million installs, ten years inside the official store, undetected. When detection fails that completely, the answer is not better detection.
Security researchers at Socket just documented 319 Chrome extensions, with an estimated 13.4 million installs accumulated over roughly a decade, that quietly hijacked users' searches (Malwarebytes). They posed as ordinary tools, PDF converters, manual finders, "safe search," and "AI search," and were promoted through ad networks including Google Ads. Once installed, they changed the default search engine and routed every query through servers the operators controlled, giving those operators a view of what people searched for, tied to a persistent identifier, before the search was passed along to Yahoo or Bing.
The detail worth sitting with is the timeline. These extensions lived in Google's own store for about ten years. Most were unlisted, meaning a direct link would take you to a normal-looking store page while an ordinary store search would never surface them. An ad offered help with an immediate task, a landing page nudged the install, and the official store provided a trusted place to click "Add." Nothing about that flow looked wrong to the person doing it, or, for a decade, to the defenses meant to catch it.
Key takeaways
319 Chrome extensions with about 13.4 million installs hijacked users' searches for roughly a decade from inside the official Chrome Web Store.
They were disguised as useful tools and promoted through ads, and most were unlisted, so they were installed by direct link rather than found through store search.
The lesson is not "spot the bad extension sooner." It went unspotted for ten years by the people best positioned to catch it.
A browser extension runs with deep access to what you do in the browser, which is exactly why an unapproved one has no business being active while you are on your bank or payroll provider.
Haven Business takes a different path: instead of judging which extensions are malicious, it approves the few you trust and switches off the rest while a protected site is open.
Keep your business safe from online threats
Haven for Business protects every employee from phishing, fake sites, and browser-based attacks.
Why detection kept missing it
It is tempting to treat this as a story about Google needing a better review process, or about users needing to be more careful. Both are fair. Neither is a plan you can run your business on.
Detection struggles with this threat for structural reasons. The extension was useful, it really did convert PDFs or find manuals, so behavior alone did not scream malware. It lived in the official store, which is the trusted source everyone is told to use. It was unlisted, so it was not sitting in search results waiting to be flagged. And the harmful part, routing a search query through an extra server, looks a lot like the ordinary plumbing of a legitimate search tool. Multiply that by 319 variations and a decade of patience, and you can see why nobody caught it.
This is the uncomfortable pattern behind most extension incidents we have written about, from malicious extensions that steal sessions to the consumer-side explainer on what a bad extension can actually do. The extension is not a file your antivirus scans once. It is trusted code running inside the browser, with standing permission to see and change what happens on the pages you visit. If you are waiting to be told which one is dangerous, you are waiting on a judgment that, in this case, took ten years to arrive.
The real risk is access, not identity
Step back from whether any single extension is "good" or "bad," and look at what an extension can do. A browser extension can be granted permission to read and change the content of the pages you open. That is a lot of reach, and it is the same reach whether the extension is a beloved password manager or a search hijacker nobody has flagged yet.
Now put that next to the pages that matter most: your bank, your payroll provider, your company's financial tools. Those are the sessions where that level of access does real damage, and they are exactly the sessions where you least want unknown code looking over your shoulder. The problem is not that you have extensions. It is that every extension you have installed is active on those sensitive pages too, including the one you have not learned to distrust yet.
A different approach: approve the few, switch off the rest
Haven Business does not try to decide which of your extensions is malicious. We want to be precise about that, because it is the whole point. It does not score extensions by their permissions, inspect their behavior, or check their IDs against a threat list. It makes no judgment about good or bad.
Instead, it works from an approved list. When someone in your organization has a protected site open, a verified banking or financial site, Haven Business turns off every extension that is not on that approved list, for the duration of that session. The password managers and tools your team actually needs stay on because you approved them. Everything else, including an extension like one of these 319 that nobody has flagged, is simply switched off while the sensitive page is open. When the person leaves that site, their extensions return to normal.
The reason this matters for a story like Socket's is that it does not depend on anyone catching the bad extension first. A search hijacker that evaded detection for ten years is still not on your approved list, so it is still turned off during the session that counts. You are not betting on detection. You are deciding, in advance, the short list of extensions allowed to run while your people are on your most sensitive sites, and defaulting everything else to off.
Administrators set the approved list for the organization. Where a tenant has not defined one, Haven falls back to a small built-in list of common password managers and a couple of Google utilities, so core tools are not caught off guard. Teams that want to see the impact before enforcing anything can run in a monitor-only mode, which records what would have been turned off without turning anything off.
What this does, and does not, do
We would rather be clear about the edges than let the idea oversell itself.
This protection applies while a protected site is open. It is built to keep unapproved extensions away from your most sensitive sessions, not to scrub a questionable extension from the machine or to stop it from acting during ordinary, everyday browsing. If a search-hijacking extension is installed, Haven Business keeps it from operating on the protected site, but removing it for good is still a cleanup step for the user or the administrator.
It is also not a verdict on any extension. Because Haven works from an approved list rather than a malware judgment, it will switch off a harmless-but-unapproved extension during a protected session just as readily as a harmful one, and it will not tell you which of your installed extensions was the dangerous one. The goal is narrower and more reliable than detection: during the sessions that matter, only the extensions you approved are allowed to run.
Finally, an extension your organization installs centrally, or one the user is not permitted to turn off, is left alone, and in that case Haven does not mark the page as protected. The approach is about the extensions a person can add on their own, which is where incidents like this one begin.
The takeaway
The honest reading of a decade-long, 13.4-million-install search hijack is that detection is not where this gets solved. Ten years is a long time to wait for someone to decide an extension is malicious. The durable move is to stop depending on that decision for your most sensitive moments, and to let only the extensions you trust run while your team is signed in to the accounts that matter.
About Haven
Haven helps people and organizations make safer trust decisions online. Haven is a browser extension that flags fake and impersonated login pages, suspicious links, and look-alike sites, and pauses risky downloads, by analyzing the actual page in front of you rather than only checking it against a list of known-bad sites. Haven is free for individual use. Haven Business extends protection across a team and adds controls like approving which extensions may run while employees are on your most sensitive sites. Haven is operated by MirrorTab Corp.
