Microsoft App Quietly Installs Bing as Default Search in Browsers

Key Takeaways

• Microsoft has released a new Windows 11 application designed to promote Bing as the default search engine across multiple browsers.
• The utility, named “Microsoft Recommended Search Settings” (MicrosoftSettings.exe), installs Bing extensions and prompts users to switch their default search provider.
• While not a silent installation, the app employs tactics like pre-selected “Yes” options and official-looking filenames, which could lead less-vigilant users to inadvertently accept the changes.
• The process affects Microsoft Edge, Mozilla Firefox, Google Chrome, and potentially Brave, raising concerns about browser control and user choice.

Microsoft has deployed a dedicated Windows 11 application with the specific objective of integrating Bing as the primary search engine for users who may have previously opted for alternative providers. This new utility, known as “Microsoft Recommended Search Settings,” is distributed as a standalone 22.2 MB executable file, MicrosoftSettings.exe.

The installer is hosted on Microsoft’s official download infrastructure rather than being delivered via Windows Update or the Microsoft Store. Its function is straightforward: install a Bing browser extension, prompt the user to make Bing their default search engine, and subsequently direct them to the Microsoft Rewards program.

According to Windows Latest, a tester identified as Xeno Panther first uncovered this executable. During a practical assessment on a system where Google was set as the default in Chrome and Brave Search in Brave, the initial interface presented a “Welcome to Microsoft Recommended Search Settings” message, with the option to enable Bing already pre-selected to “Yes.”

Fine print on the screen indicated that the proposed changes would apply to Microsoft Edge, Mozilla Firefox, and Google Chrome. Proceeding by clicking “Accept and continue” initiated a brief setup process, culminating in a “You’re all set!” confirmation page. Clicking the “Finish” button then launched rewards.bing.com/m365offer in the Edge browser.

Pushing Bing Across Browsers

The method of delivery and presentation of this application warrants attention from cybersecurity professionals. Microsoft has packaged this campaign within a WinUI shell utilizing WebView2, assigning the file a name that closely resembles a legitimate system tool. The accompanying browser add-on, “Microsoft Bing Homepage & Search,” is not a new component; it is already available in the Chrome Web Store under Microsoft Corporation, boasting approximately five million users.

What is novel, however, is this Windows-native distribution channel that can influence Chrome, Firefox, and, based on testing, Brave, before ultimately redirecting users to a Microsoft Rewards page.

Both Chrome and Brave intervened during the installation process. Chrome issued a warning, detailing that the extension sought permissions to read and alter all data on websites, display notifications, and replace the user’s homepage, start page, and search settings with bing.com.

These requested permissions are notably extensive, mirroring the powerful hooks often exploited in malicious search-hijacking schemes and deceptive AI search extensions that reroute user queries through unauthorized third-party infrastructure. While Microsoft’s add-on is a first-party product and not a malicious implant, granting such broad permissions still represents a significant decision regarding browser control. Once activated, Chrome’s new tab page, for instance, could revert to the often-cluttered MSN feed, overriding the user’s preferred start experience.

Google Chrome subsequently attempted to revert the default search setting. After Bing was established as the default, Chrome prompted the user with “Change back to Google Search?” Microsoft then countered this with a secondary dialog box aimed directly at the restore button, stating, “Wait, don’t change it back!” and warning that undoing the change would disable the extension. This “prompt war” dynamic in Chrome was previously documented by Windows Latest in March 2024.

It is important to note that this is not a silent or forced takeover. Microsoft has not indicated that the app will be deployed automatically, and both the Windows wizard and the browser require explicit user clicks to proceed. Nevertheless, the pre-selected “Yes” option, the official-looking filename (MicrosoftSettings.exe), and the Microsoft Rewards incentive are designed to encourage users to click through without careful consideration. Individual users should decline MicrosoftSettings.exe unless they specifically desire Bing and MSN integration.

What You Should Do

• For Home Users: Exercise caution when encountering “Microsoft Recommended Search Settings” or “MicrosoftSettings.exe.” Unless you specifically intend to switch to Bing as your default search engine, decline the installation and any prompts to change your browser settings.
• For Administrators and IT Teams: Treat this as a browser extension policy concern. Implement and enforce policies to block unapproved search add-ons in Google Chrome, Mozilla Firefox, and other browsers like Brave. Regularly review and audit browser extension installations across your network to maintain control over user search experiences and prevent unwanted modifications.
• Educate Users: Inform end-users about the tactics used by such applications, including pre-selected options and official-looking filenames, to encourage them to read prompts carefully before clicking “Accept” or “Continue.”

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.