Chrome Moves to Block Malware That Hijacks Your New Tab Page

Key points

• Google is building a Chrome feature that blocks policy-installed extensions from taking over the New Tab page or default search engine on unmanaged Windows and macOS devices.
• The protection targets malware that abuses Chrome's enterprise policy system, meant for company IT teams, to lock malicious extensions onto ordinary home computers.
• Chrome will record blocked extension IDs and stop retrying downloads, cutting off repeated hijack attempts.
• Manually installed extensions can no longer be silently converted into locked, policy-controlled ones.
• The code changes are still under review in Chromium and have not shipped to stable Chrome.

Google is preparing a Chrome defence aimed at a long-running trick used by browser hijackers: pretending to be a company IT department so the browser will not let you remove a malicious add-on.

The work-in-progress changes were first spotted by BleepingComputer in Chromium's public code review system. Once approved, Google plans to switch the protection on by default.

What is actually being abused here?

Chrome lets organisations use enterprise policies, which are settings normally pushed by a company's IT team, to force-install extensions and lock browser settings. That is fine on a work laptop tied to a corporate domain. It is not fine when malware writes the same policy settings onto a home PC.

Once those local policy keys are in place, Chrome treats the malicious extension as if an administrator installed it. You cannot disable it. You cannot remove it. Chrome may even flash the message "Managed by your organization" on a computer that no organisation owns.

Google calls these consumer machines "low-trust" environments, because Chrome is reading policy settings from the local disk without any check against a real corporate management service.

What will the new protection do?

On unmanaged Windows and macOS devices, Chrome will refuse to install policy-controlled extensions that override the New Tab page or the default search engine. The installation is cancelled and the extension's ID is written to a blocked list.

Chrome then stops trying to download that same extension on later policy checks. That kills the repeated reinstall loop hijackers often rely on.

Google is closing a second loophole at the same time. An extension you installed yourself, by choice, will no longer be silently upgraded into a locked, policy-managed extension behind your back. It stays under your control, and you can still turn it off or uninstall it.

There is also a cleanup step. If a device used to be genuinely managed but has lost that status, and stale local policy keys are still sitting on the disk, Chrome will automatically uninstall any affected New Tab or search-engine override extensions.

What about real IT departments?

Legitimate administrators keep an escape hatch. A separate enterprise policy will let them disable the new block when a required work extension genuinely needs to change the New Tab page or search engine. Google is also adding usage metrics so it can track how often these hijackers appear in the wild and how often Chrome stops them.

When will it reach my browser?

Not yet. The code changes, tracked in Chromium's Gerrit review system, are still under review. Google's engineer Anunoy Ghosh wrote that the feature flag, named kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, will be enabled by default once the changes land, activating what he called an "end-to-end blocking defense" on unmanaged Windows and macOS devices.

What should ordinary users do now?

If your Chrome shows "Managed by your organization" and you do not work for one, treat it as a red flag. Run a reputable anti-malware scan, check Chrome's extensions page, and look under Windows Registry or macOS configuration profiles only if you are comfortable doing so. Otherwise, ask someone who is. Reinstalling Chrome alone will not always fix it, because the policy keys live outside the browser.