Google is taking steps to protect users from malicious extensions that hijack the New Tab page and default search engine on unmanaged computers. The tech giant has proposed a new security feature for Chrome that would block these types of extensions by default, preventing them from installing or overriding browser settings.
The issue arises when malicious programs add local Chrome policy keys without user permission, allowing attackers to force-install extensions that replace the New Tab page, change search engines, or redirect searches to suspicious websites. Chrome often mistakenly identifies these extensions as legitimate, installed by an administrator, making it difficult for users to remove them. In some cases, Chrome even displays a misleading “Managed by your organization” message on unmanaged PCs.
To combat this problem, Google is enabling the kBlockDseNtpOverrideExtensionsOnUnmanagedDevices feature flag by default in Chrome. This will block attempts to install policy-controlled extensions that override the New Tab page or default search engine, preventing them from installing or overriding browser settings. If a user tries to install one of these extensions, Chrome will cancel the installation and save the extension ID in a blocked-extension preference, stopping repeated installation attempts and unnecessary network activity.
Another aspect of this protection is that it prevents malicious extensions from converting manually installed extensions into locked, policy-controlled ones. This means users can still disable or remove them if needed. Additionally, when an unmanaged device loses its trusted management status but still has local policy keys, Chrome will automatically uninstall affected New Tab and search-engine override extensions.
Google is also working on metrics to measure the frequency of these policy-based hijackers and how often Chrome blocks them. Furthermore, legitimate administrators will have access to a special policy that disables this protection when an enterprise extension overrides the New Tab page or search engine.
This move from Google highlights the importance of security measures in protecting users from malicious activities. As technology continues to advance, so do the tactics used by attackers. It’s essential for browser developers and security teams to stay one step ahead of these threats and provide effective solutions to safeguard users’ online experience.
If you’re a Chrome user, this development should be reassuring. However, it’s crucial to remember that even with robust security measures in place, users must remain vigilant and test every layer before attackers do.
Source: Bleeping Computer — 2026-08-02