Plan
active
Chrome extensions with 13.4M installs caught hijacking searches
- Engineer — Plan: Enterprises with unmanaged Chrome deployments have real exposure here. Obtain the list of 319 extension IDs from BleepingComputer’s reporting, audit managed Chrome environments via the Extension Management policy, and blocklist or remove any matches.
- SOC/IR — Plan: Retrieve the tracking/redirect domains associated with the campaign and create proxy or DNS detections for search queries being routed through third-party advertising servers; also sweep historic proxy logs for hits against those domains since installation dates.
- Leader — Learn: A 13.4M-install adware campaign is a useful data point for justifying a browser extension governance policy — this reinforces the case for allowlisting or vetting Chrome extensions in managed enterprise environments, but there is no immediate leadership action unless internal exposure is confirmed.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.