Google Chrome currently allows enterprise policies to force-install extensions and control browser settings, which can be abused by malware on unmanaged consumer devices to hijack the New Tab page or default search engine. Google is preparing a feature that blocks such policy-installed extensions on unmanaged Windows and macOS devices by default. The feature cancels installation of extensions that override these settings, blocks repeated installation attempts, and prevents manual extensions from being converted into locked policy-controlled extensions. If a device loses trusted management, Chrome will uninstall affected extensions automatically. This feature is under review and not yet available in stable Chrome.

Malicious software can abuse Chrome's enterprise policy extension installation mechanism on unmanaged consumer devices to force-install extensions that hijack the New Tab page or change the default search engine, potentially redirecting users to suspicious sites and preventing removal or disabling of these extensions. This can degrade user experience and expose users to unwanted content or tracking. The new feature will mitigate this abuse by blocking such extensions, reducing the risk of persistent browser hijacking on consumer PCs.

This protection is not yet released but will be enabled by default once approved. Users should monitor Chrome updates for the availability of this feature. Legitimate administrators can disable the protection via an escape-hatch policy if necessary. No immediate action is required until the feature ships. Once available, the feature will automatically block and uninstall hijacking extensions installed via policies on unmanaged devices.