Chrome Moves to Block Malware That Hijacks Your New Tab Page

Key points

• Google is building a Chrome feature that blocks policy-installed extensions from taking over the New Tab page or default search engine on unmanaged Windows and macOS devices.
• The protection targets malware that abuses Chrome's enterprise policy system, meant for company IT teams, to lock malicious extensions onto ordinary home computers.
• Chrome will record blocked extension IDs and stop retrying downloads, cutting off repeated hijack attempts.
• Manually installed extensions can no longer be silently converted into locked, policy-controlled ones.
• The code changes are still under review in Chromium and have not shipped to stable Chrome.

Google is preparing a Chrome defence aimed at a long-running trick used by browser hijackers: pretending to be a company IT department so the browser won't let you remove a malicious add-on.

The work-in-progress changes were first spotted by BleepingComputer in Chromium's public code review system. Once approved, Google plans to switch the protection on by default.

What is actually being abused here?

Chrome lets organisations use enterprise policies, settings normally pushed by an IT team, to force-install extensions and lock browser settings. That's fine on a work laptop tied to a corporate domain. It isn't fine when malware writes the same policy settings onto a home PC.

Once those local policy keys are in place, Chrome treats the malicious extension as if an administrator installed it. You can't disable it or remove it. Chrome may even flash the message "Managed by your organization" on a computer that no organisation owns.

Google calls these consumer machines "low-trust" environments because Chrome reads policy settings from the local disk without checking against a real corporate management service. The extension-as-administrator angle is one we've tracked across our Chrome coverage this year, where rogue add-ons repeatedly surface as the attack surface of choice.

What will the new protection do?

On unmanaged Windows and macOS devices, Chrome will refuse to install policy-controlled extensions that override the New Tab page or the default search engine. The installation is cancelled and the extension's ID is written to a blocked list.

Chrome then stops trying to download that same extension on later policy checks, killing the repeated reinstall loop hijackers rely on.

Google is closing a second loophole at the same time. An extension you installed yourself will no longer be silently upgraded into a locked, policy-managed extension. It stays under your control, and you can still turn it off or uninstall it.

There's also a cleanup step. If a device used to be genuinely managed but has since lost that status, and stale local policy keys remain on the disk, Chrome will automatically uninstall any affected New Tab or search-engine override extensions.

What about real IT departments?

Legitimate administrators keep an escape hatch. A separate enterprise policy will let them disable the new block when a required work extension genuinely needs to change the New Tab page or search engine. Google is adding usage metrics to track how often these hijackers appear in the wild and how often Chrome stops them.

When will it reach my browser?

Not yet. The code changes, tracked in Chromium's Gerrit review system, are still under review. Google engineer Anunoy Ghosh wrote that the feature flag, named kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, will be enabled by default once the changes land, activating what he called an "end-to-end blocking defense" on unmanaged Windows and macOS devices.

Should you worry now?

If your Chrome shows "Managed by your organization" and you don't work for one, treat it as a red flag. Run a reputable anti-malware scan and check Chrome's extensions page. Reinstalling Chrome alone won't always fix it, because the policy keys live outside the browser.

The honest read here: this is a sensible fix for a well-worn attack, but it's still weeks or months from stable users. Medium confidence it ships without significant changes; the admin override clause suggests Google has done enough internal consultation that this isn't going to be quietly abandoned.