Google is developing a Chrome security feature to block policy-installed extensions from hijacking the New Tab page or changing the default search engine on unmanaged consumer devices, as indicated by ongoing Chromium Gerrit changes.
This feature is not yet available in stable Chrome, but Google intends to enable it by default once approved. The update targets malware that exploits enterprise policy mechanisms on Windows and macOS consumer PCs.
These changes are under review, and the protection is not yet available in stable Chrome.
How Chrome’s New Tab and Search Hijacking Works
Chrome allows organizations to use enterprise policies to force-install extensions and manage browser settings. While this is appropriate for managed work devices connected to a domain or mobile device management system, malware can exploit the same feature on consumer PCs.
Malicious programs can add local Chrome policy keys without user consent, forcing the installation of extensions that replace the New Tab page, change the search engine, or redirect searches to suspicious websites.
Chrome treats these as administrator-installed extensions, preventing users from removing or disabling them. In some cases, Chrome displays a “Managed by your organization” message even if the PC is not managed by any organization.
Google refers to these consumer PCs as “low-trust” environments because Chrome reads locally stored policies without verification from a trusted authority such as a domain or MDM service.
“In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers,” Google’s Anunoy Ghosh wrote in a post.
The change “enables the kBlockDseNtpOverrideExtensionsOnUnmanagedDevices feature flag by default, activating the end-to-end blocking defense on unmanaged Windows and macOS devices.”
With the proposed protection, Chrome would block installation of policy-controlled extensions that override the New Tab page or default search engine on unmanaged devices.
The installation would be canceled, and Chrome would record the extension ID in a blocked-extension list. Chrome would also stop attempting to download the same blocked extension during future policy checks, reducing repeated installation attempts and unnecessary network activity.
Google is also addressing a related issue. Extensions installed manually by users will no longer be converted into locked, policy-controlled extensions, ensuring users retain the ability to disable or remove them.
If a previously managed device loses its trusted management status but retains local policy keys, Chrome will automatically uninstall affected New Tab and search engine override extensions.
How Chrome Will Protect Managed and Consumer Devices
Legitimate administrators will retain access to an escape-hatch policy that disables this protection when a required enterprise extension must override the New Tab page or search engine. This approach preserves functionality for managed environments while blocking abuse on consumer devices.
Google is also implementing metrics to track the frequency of policy-based hijackers and how often Chrome blocks them.
Because this protection is not yet available, users who suspect a New Tab or search engine hijacker on a personal device can take the following manual steps: type policy in the address bar to see whether unexpected policies are set on an unmanaged personal device.
- Investigate any extension marked as installed by an administrator or accompanied by a “Managed by your organization” message on a PC that is not managed by an organization.
- Run a reputable anti-malware scan, as malicious local policy keys are typically added by a separate program on the system.
- Remove the local policy keys and any associated malware, as deleting the extension alone may not prevent reinstallation if the policy remains.
Availability
The Gerrit changes remain under review, and the feature is not yet available in stable Chrome. Google plans to enable the protection by default on unmanaged Windows and macOS devices once approved, but has not announced a target Chrome version or release date.
The escape-hatch policy for legitimate enterprise extensions will remain available for managed environments when the protection is released.
Thank you for being a Ghacks reader. The post Google Chrome Prepares Default Block for Extensions That Hijack the New Tab Page or Search Engine appeared first on gHacks.
