Koi Security specialists discovered 11 malicious extensions in the official Chrome Web Store.
The extensions were capable of tracking users' actions, collecting browser activity data, and redirecting them to potentially dangerous websites.
"In total, these eighteen extensions infected more than 2.3 million users of both browsers.
Due to the nature of the extension update process in Google and Microsoft browsers, malicious versions were installed silently and automatically.
This is one of the largest browser hijacking campaigns we have ever encountered," the researchers write.