[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbpsCJ_3i6MJLOoYz2ti32QCV7xM4Q3S5ifBWcZ2dSu8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"ba65f49b-8e9a-4aad-ba6a-2ea99ea0258f","134-million-users-hit-by-chrome-extension-search-hijacking-campaign","67ec184f-aefa-42fb-a85e-57983aa69c9b","13.4 Million Users Hit by Chrome Extension Search-Hijacking Campaign","Over 300 malicious Chrome extensions, disguised as everyday productivity tools like PDF converters, were able to infiltrate the browser ecosystem and hijack user searches by routing them through attacker-controlled proxy servers. The root problem lies in users' inability to distinguish legitimate extensions from malicious ones, combined with insufficient vetting in the browser extension supply chain. This matters because extensions operate with elevated browser privileges, making them powerful vectors for data theft, phishing, and advertising fraud. The scale of 13.4 million installs demonstrates how easily trust in familiar-looking tools can be weaponized at a massive level.","**Immediate actions:**\n- Audit all installed browser extensions across the organization and remove any that are unrecognized, unnecessary, or flagged by threat intelligence feeds.\n- Use endpoint management tools (e.g., Google Workspace or Intune) to blocklist unapproved extensions and enforce an allowlist policy for browser add-ons.\n\n**Long-term improvements:**\n- Establish a formal browser extension governance policy that requires security review and approval before any extension may be installed on corporate devices.\n- Integrate browser extension inventory into your asset management process so new or changed extensions trigger an alert for review.\n- Partner with threat intelligence services to receive timely notifications when extensions in your environment are flagged as malicious.\n\n**Detection measures:**\n- Deploy network monitoring to detect anomalous DNS queries or traffic rerouting consistent with search-hijacking proxy behavior.\n- Enable endpoint detection and response (EDR) logging for browser process activity to identify extensions making unexpected outbound connections.",[12,13,14,15,16,17,18],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation",{"MITRE ATT&CK T1566: Phishing":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"OWASP A06:2021 Vulnerable and Outdated Components":22,"CIS Control 14: Security Awareness and Skills Training":23,"CIS Control 2: Inventory and Control of Software Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"The extensions were designed to redirect users to phishing sites, making this a direct delivery mechanism for phishing attacks that user awareness and network controls could help mitigate.","A systematic process for identifying and remediating flawed or malicious software — including browser extensions — would have triggered faster detection and removal of the 319 implicated extensions.","Reliance on unvetted third-party browser extensions mirrors the risk of using vulnerable components, where malicious or compromised add-ons introduce critical security weaknesses into an otherwise secure environment.","Users who understand the risks of installing browser extensions from unverified sources are far less likely to install malicious tools disguised as PDF converters or similar utilities.","Maintaining an approved inventory of permitted browser extensions would have prevented unapproved, malicious extensions from being installed across user devices at scale.","Organizations are required to identify and address vulnerabilities in software in use, including third-party browser extensions that introduce unacceptable risk to the browsing environment.","Restricting which browser extensions can be installed via access control policies would have limited exposure by ensuring only vetted, approved extensions run in the browser environment.","published","2026-10-29T17:21:26.794877+00:00","2026-10-29T17:21:26.783+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchrome-extensions-with-134-million-installs-caught-hijacking-searches\u002F","chrome-extensions-with-13-4-million-installs-caught-hijacking-searches-e12152","Chrome extensions with 13.4 million installs caught hijacking searches",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]