Google is fighting to protect users from ad injectors—those pesky programs that insert or replace ads in pages you visit while browsing the Web.

In just three months, the search giant received more than 100,000 complaints about Chrome-based ad injection, which topped gripes about network errors, performance problems, or any other issue.

Ad injectors are part of what software engineer Nav Jagpal called(Opens in a new window) “an environment where bad practices hurt users, advertisers, and publishers alike.” They are more than just intrusive. Users can be tricked into installing unwanted software, and the programs have also been linked to major security risks like Superfish.

But don’t automatically point your finger at advertisers. According to Jagpal, marketing companies are often unaware that their ads are crawling onto your browser.

Publishers suffer, too. Most importantly because they may be unwittingly drawing visitors into a trap; if nothing else, they are also not being compensated for the injected ads.

So what’s Google gonna do about it?

“To increase awareness about ad injectors and the scale of this issue, we’ll be releasing new research on May 1 that examines the ad injector ecosystem in depth,” Jagpal wrote.

Conducted with University of California Berkeley researchers, the study drew conclusions from more than 100 million global pageviews of Google sites on Chrome, Firefox, and Internet Explorer, running on various operating systems.

“It’s not a pretty picture,” Jagpal said.

Recommended by Our Editors

Lenovo’s Worst Superfish Sin? Getting Caught

More than 5 percent of people visiting Google sites have at least one ad injector installed on any of the tested Web browsers and operating systems. About 34 percent of Chrome extensions injecting ads were classified as outright malware.

“We’re constantly working to improve our product policies to protect people online,” Jagpal wrote. “We encourage others to do the same. We’re committed to continuing to improve this experience for Google and the Web as a whole.”

In the meantime, Chrome users can choose to install injectors that clearly disclose what they do. Those that sneak ads into a browser, however, violate Google’s policies, and produce a red warning before someone downloads deceptive software.

On the flip side, AdWords advertisers hosting software downloads on (or linked to from) their site must comply with the Unwanted Software Policy. Plus, the Google Platforms program policies and DoubleClick Ad Exchange (AdX) Seller Program Guidelines do not allow programs that overlay ad space on a given site without permission of the site owner.