Introduction
Google Chrome is preparing a new security feature to stop malicious extensions from taking over your browser. The update will block policy-installed extensions from hijacking your New Tab page or changing your default search engine.
This is a big win for everyday users who have been dealing with frustrating browser hijackers.
The new protection is designed to stop malware from forcing unwanted extensions onto your Chrome browser.
What Is the Problem?
Right now, Chrome allows organizations to use special policies to force-install extensions. This is useful for companies that manage their employees' devices.
However, hackers have been abusing this same feature. A malicious program can add fake policy keys to your computer without your knowledge. This forces Chrome to install a bad extension that:
- Changes your New Tab page
- Replaces your default search engine
- Redirects your searches to suspicious websites
Once installed, Chrome believes the extension was installed by an administrator. This means you cannot remove or disable it. You may also see a confusing message saying "Managed by your organization," even if your computer is personal.
How Will the New Protection Work?
Google is adding a feature called kBlockDseNtpOverrideExtensionsOnUnmanagedDevices. This will block any policy-installed extension that tries to override your New Tab page or search engine.
Here is what happens when the protection is enabled:
- Chrome will cancel the installation of the hijacking extension
- The extension ID will be saved in a blocked list
- Chrome will stop trying to install the same extension again
- This prevents repeated installation attempts and unnecessary network activity
Other Improvements
Google is also fixing another trick used by malware. Previously, if you installed an extension manually, malware could convert it into a locked, policy-controlled extension. This would prevent you from removing it.
With the new protection, any extension you install manually will stay under your control. You will still be able to disable or remove it.
If a device loses its managed status but still has old policy keys, Chrome will automatically uninstall any affected extensions that override the New Tab page or search engine.
What About Legitimate Administrators?
Google understands that some businesses need to install extensions for legitimate reasons. The company is adding an escape-hatch policy that allows administrators to disable the protection when needed.
This ensures that businesses can still manage their devices while keeping regular users safe.
When Will This Be Available?
The feature is still being reviewed by the Chromium team. It has not shipped in a stable version of Chrome yet. However, Google plans to enable it by default once the changes are approved.
What You Can Do Right Now
While we wait for this feature to arrive, here are some steps you can take to protect your browser:
- Be careful with downloads. Only download software from trusted sources.
- Check your extensions regularly. Remove any you do not recognize.
- Look for the "Managed by your organization" message. If you see this on a personal computer, check your settings immediately.
- Keep Chrome updated. Updates often include important security fixes.
- Use trusted antivirus software. This can help detect and remove malware before it causes problems.
Final Thoughts
This new Chrome security feature is a welcome change. It will make it much harder for hackers to hijack your browser using policy-installed extensions.
Until the feature is available, staying cautious and checking your browser settings regularly is the best defense.
If you need help securing your business devices, contact SystemLogicIT for a free security assessment.