Manifest V3: More Secure, But Still Dangerous in the Wrong Hands
Malicious Chrome extensions exploiting Manifest V3 are browser add-ons that use the framework’s legitimate permissions and network APIs to silently intercept and redirect your searches, collect detailed browsing data, and route traffic through attacker-controlled servers while still showing you normal results, making the spying almost impossible to notice in daily use. Google has promoted Manifest V3 as a safer extension model than Manifest V2, arguing that it reduces security risks and technical debt tied to legacy behavior. The recent discovery of a Manifest V3-based attack is a blunt reminder: architectural security improvements do not matter if you hand broad powers to untrustworthy extensions. The threat is no longer confined to obvious adware; it is hiding in polished, AI-branded tools that look harmless and behave “normally” on the surface, while they quietly log every character you type in the address bar.
How One Malicious Chrome Extension Hijacked Perplexity AI Searches
Microsoft’s Defender Security Research team uncovered a malicious Chromium extension pretending to be a Perplexity AI search tool, named “Search for perplexity ai.” It impersonated the real AI service with a typosquatted domain, perplexity-ai[.]online, and then configured itself as the browser’s default search provider. From that moment, every search ran through attacker-controlled infrastructure before being redirected to legitimate engines like Perplexity, Google, or Bing, creating a convincing illusion of normal behavior. The extension went further: by overriding Chrome’s search suggestions, it captured every character typed into the address bar and transmitted it to its servers before users even pressed Enter. Those servers logged search queries, browser details, HTTP headers, and IP addresses, turning what looked like a helpful AI search add-on into a quiet data collection system. Google removed the extension from the Chrome Web Store after responsible disclosure, but the incident shows how easily browser search hijacking can be disguised as a feature.
Manifest V3 Security: Legitimate APIs Used for Stealthy Search Hijacking
The dangerous part of this incident is that it does not rely on a bug in Manifest V3; it exploits the framework exactly as designed. The malicious extension leaned heavily on Declarative Net Request (DNR) APIs, which exist to let extensions filter and redirect network requests in a controlled way. In the attacker’s hands, those APIs enabled a two-hop workflow: user searches first reached the attacker’s servers, where data was logged, and were then passed straight on to genuine search providers. Victims saw normal results, so nothing looked wrong. Google’s engineers have argued that Manifest V2 must go because of security risks and the complexity involved in keeping old behavior around. They are not wrong—but this case proves that “more secure than V2” does not mean safe by default. Manifest V3 still allows extensions broad access to your browsing activity when you grant search and network permissions, and malicious Chrome extensions can abuse those powers just as effectively as honest ones use them.
What You Should Do Now: Detecting and Avoiding Browser Search Hijacking
If you treat browser extensions like harmless add-ons, you are giving attackers a perfect opening. Start by reviewing every extension you have installed and ask a simple question: does this tool truly need control over my search settings or network traffic? Microsoft’s researchers advise installing extensions only from trusted publishers, verifying official domains before downloading AI-themed tools, and paying close attention to requested permissions—especially anything touching default search, search suggestions, or request filtering. In practice, watch for signs of browser search hijacking: unexpected changes to your default search engine, searches briefly “flashing” a strange URL before loading results, or new slowdowns when typing in the address bar. If you see any of these, disable the suspicious extension, remove it, and clear related browser settings. The safest stance is skeptical: assume every extension is capable of overreach until its permission requests and behavior prove otherwise.
The Real Lesson of Manifest V3: Extension Permissions Are the New Attack Surface
The discovery of a Manifest V3-based data collection extension should change how we think about browser security. The real risk is not the framework; it is the extension permissions we grant without reading. Manifest V3 raises the security bar compared with V2, but attackers have already adapted, misusing legitimate APIs in ways that are almost invisible to ordinary users. As AI branding becomes a convenient lure, you should expect more malicious Chrome extensions to pose as smart productivity tools while quietly turning your browser into a sensor for their servers. Responsible disclosure and store removals help, but they will always be reactive. Proactive protection means treating extension installation like installing any other powerful software: scrutinize permissions, confirm the publisher and domain, and remove anything you do not fully trust. Your browser’s search box is a window into your interests, concerns, and plans. With Manifest V3, it is safer than before—but only if you stop handing that window to strangers.
