Searchjacked: browser extensions can expose your team's searches

By AgentDASTPublished Nov 3, 2026Sources checked Nov 3, 2026

First reported Oct 29, 2026

Socket's Searchjacked research describes browser extensions that route search queries through operator-controlled servers before showing results from established search engines. Its expanded investigation identifies 319 extensions and estimates 13.4 million installs across a decade. That is a cumulative estimate, not a count of people newly compromised this week.

Who should check

People who installed the listed extensions, often promoted as PDF converters, manual finders or search tools. Malwarebytes explains how ads and official Chrome Web Store listings helped the installation funnel look familiar. Search terms can disclose sensitive work or personal information even when the final results page looks normal.

What to do now

Review installed browser extensions against Socket's published list. Remove untrusted or unnecessary tools, including extensions installed through ads.
Check the browser's search-engine settings after removal. Investigate settings controlled by an unexpected extension.
For managed devices, review extension installation policies and permission changes. Treat searches containing internal URLs or operational details as potentially sensitive.

What this means for your website

The reported behavior exposes search queries; it is not evidence that every affected user's passwords were stolen. Malwarebytes notes that malicious redirects were a possible capability, not an observed outcome in this investigation. A website assessment does not inspect employees' browsers, so this calls for a separate endpoint review.

Sources and updates

This brief reflects the sources checked on Nov 3, 2026. Follow the linked vendor notices for subsequent corrections and updates.

Find your own weak spots.

Test your live website and give your coding agent evidence it can act on.

Set up your agent →