Google Chrome Plans to Block New Tab Hijacker Extensions on Unmanaged Devices by Default

Google is developing a Chrome security feature that would prevent policy-installed extensions from hijacking users' New Tab pages or replacing their default search engines on consumer devices, according to work-in-progress changes spotted in the Chromium Gerrit code repository.

The feature, first reported by BleepingComputer, has not shipped yet, but Google intends to enable it by default once the relevant changes receive approval.

The protection centers on what Google internally describes as "low-trust" environments — unmanaged consumer PCs on which Chrome reads locally stored policy keys without confirmation from a domain controller or mobile device management service.

"In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers," Anunoy Ghosh, a Google engineer, wrote in a post accompanying the code changes.

Chrome currently permits organizations to use enterprise policies to force-install extensions and govern browser settings — a legitimate capability on properly managed corporate devices. On consumer machines, however, malicious software can write local Chrome policy keys without user consent, effectively tricking Chrome into treating a rogue extension as one sanctioned by an administrator.

The result can be a browser whose New Tab page and default search engine are redirected to suspicious sites, with the extension rendered impossible to disable or remove by the user. In some instances, Chrome also surfaces a "Managed by your organization" notice on devices that have no legitimate organizational affiliation.

Under the proposed feature — identified by the flag name kBlockDseNtpOverrideExtensionsOnUnmanagedDevices — Chrome would reject any policy-controlled extension that attempts to override the New Tab page or default search engine on unmanaged Windows and macOS devices. The blocked extension's ID would be saved to a blocked-extension preference, and Chrome would stop attempting to download that extension during future policy checks, reducing unnecessary network activity.

Google is also closing a related loophole: an extension that a user installed manually could no longer be silently converted into a locked, policy-controlled extension. Such extensions would remain under the user's direct control, preserving the ability to disable or uninstall them.

The proposal also addresses devices that were once legitimately managed but have since lost that trusted status. If a device retains local policy keys after leaving a managed environment, Chrome would automatically uninstall any affected New Tab and search-engine override extensions.

To avoid disrupting genuine enterprise deployments, Google is building in an administrative escape hatch — a policy option that allows IT administrators to disable the protection when a required enterprise extension legitimately needs to override the New Tab page or default search engine.

Google is also adding telemetry to measure how frequently policy-based hijackers appear in the wild and how often the new defense successfully blocks them, reinforcing the feature's data-driven approach to rollout.

The Gerrit changes remain under review, meaning the protection is not yet present in any stable Chrome release. If approved, it would represent a targeted response to a long-standing abuse vector that has affected consumer Windows and macOS users, signaling a broader effort by Google to draw a clearer line between legitimate enterprise browser management and malware-driven policy abuse.