A free PDF tool can come with an unexpected business model. Someone searches for a supplier, the browser takes a detour, and an extension operator earns referral revenue.
Your employee still gets search results. The working day carries on. The detour is easy to miss.
For a business owner, that raises a practical question: who gets to decide what runs inside the browsers your staff use for work?
When a handy add-on changes the route
Socket’s 29 October Searchjacked investigation identified browser extensions that redirect searches through operators’ servers to collect referral revenue.
That’s the specific behaviour worth understanding. A browser extension can influence where a search goes before the results appear. A tool installed for one convenient job may also introduce an intermediary into everyday browsing.
Referral revenue doesn’t, by itself, prove that passwords have been stolen or company documents exposed. Equally, an extension doing something staff didn’t expect deserves attention.
The sensible response is to check what’s installed, what it can access and whether it still has a legitimate job to do.
Browser extensions are software, even when they look tiny
A search helper feels less substantial than an accounts package. It arrives as a small icon beside the address bar, often after a quick installation.
But extensions run code inside a tool people use for email, banking, customer records and supplier portals. Depending on their permissions, they may be able to read or change content on websites, alter search settings or interact with browsing activity.
Capabilities vary. An extension’s presence alone doesn’t establish misuse.
It does mean browser add-ons belong in your software checks. If you’d want to know who supplied an application on a company laptop, apply the same curiosity to software sitting inside its browser.
Small icon. Proper scrutiny.
Start with what’s actually installed
Ask your IT team or support provider for an inventory across the browsers and browser profiles used for work. Checking one laptop’s main browser won’t tell you what’s running elsewhere.
Record each extension’s name, publisher, purpose and permissions. Include who needs it and whether the business has approved it. Where management tools allow, use the extension’s unique identifier rather than relying on its display name alone.
Pay particular attention to search helpers, PDF converters and similar utilities installed for a one-off task. They’re useful review targets because people can forget about them once the immediate job is finished.
Avoid treating those categories as a blacklist. A legitimate PDF tool may have a clear business purpose. The question is whether this particular extension is necessary and behaving as expected.
Check the search journey
A familiar results page doesn’t tell you everything about how a search reached it.
Review the browser’s default search engine, start page and new-tab settings. Look for changes nobody remembers approving. If searches briefly pass through an unfamiliar address, ask IT to investigate rather than assuming it’s harmless or malicious.
Use a neutral test phrase. Customer names, confidential projects and account details have no place in a troubleshooting experiment involving an unknown redirect.
An unfamiliar domain is a reason to check, rather than proof of wrongdoing. Legitimate services can also use redirects. Your support provider should establish which extension or setting is responsible and whether the route is expected.
The aim is an explained search journey, with the business choosing the tools involved.
Read permissions alongside the job
Permissions make more sense when compared with what an extension is meant to do.
A tool that changes website appearance may need access to page content. A basic utility requesting broad access across websites deserves a closer look and a clear explanation.
Ask whether access can be limited to specific sites or enabled only when needed. Consider whether a trusted application or an existing browser feature already does the job.
Reviews and installation numbers can provide context, but they don’t replace a permissions check. Nor does a familiar name establish who currently maintains the software.
For developers building internal browser tools, the same discipline applies: request only the access needed, document why it’s needed and assign someone to maintain it.
Remove the extras without breaking useful work
Start with extensions that have no current purpose, lack a clear owner or duplicate an approved tool. Check dependencies before removing anything staff rely on for accessibility or essential business systems.
If an extension appears suspicious, let IT capture the details needed for investigation before making changes. Then remove or disable it as appropriate, restore approved search settings and check that the unwanted behaviour has stopped.
Where browser settings or extensions sync between profiles or devices, include that in the review. Otherwise, a tidy-up on one machine may leave the same problem elsewhere.
Removing an extension doesn’t establish whether anything else happened. Evidence of wider access or account misuse needs a proportionate security investigation.
Make the approved option easier
Staff usually install utilities because they’re trying to finish a task. Telling everyone to stop installing things leaves that task waiting.
Provide an approved way to handle common jobs such as editing PDFs or capturing web pages. Give people a straightforward route to request another tool when they need one.
For managed business browsers, consider restricting installations to approved extensions, with exceptions reviewed by IT. Test the policy with a small group before rolling it out widely.
Keep an owner and a review date for approved add-ons. An extension that was useful last year may be redundant now. Software housekeeping rarely gets applause, but neither does discovering six competing PDF converters on the same laptop.
Give browser housekeeping a place in the diary
Include extensions in routine device reviews and staff onboarding. Revisit them when someone changes role or a business application replaces an old workaround.
Give staff a simple instruction: report unexpected search changes, unfamiliar toolbars or browser behaviour they can’t explain. They don’t need to diagnose the cause.
If you’re unsure what’s running in your company browsers, that’s a useful place to start a conversation with Morse Networks. Bring the everyday tasks your staff need to complete, alongside the tools they’re using now.
Judge. Jury. Bad Extention Executioner. morsenetworks.co.uk.
Sources
- Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users — Socket · 29 Oct 2026