Chrome Moves to Block Extensions That Fake an IT Admin

Your home computer does not have an IT department. Chrome has been telling you otherwise for years. Write one registry key on a Windows machine and Chrome will install an extension silently, strip its remove button, and print a small note in the menu saying the browser is managed by your organization. There is no organization. There is malware. A Chromium change now under review would finally make Chrome check whether that claim is plausible before acting on it.

Key Takeaways

• Chrome is testing a feature flag named kBlockDseNtpOverrideExtensionsOnUnmanagedDevices that cancels policy installed extensions which override the default search engine or the New Tab page.
• The protection is scoped to unmanaged Windows and macOS devices, and as of August 2, 2026 the Chromium changes were still under review in Gerrit with no announced Chrome version or ship date.
• Malware earns its administrator status by writing Chrome enterprise policy keys such as ExtensionInstallForcelist directly into the local registry, which makes the extension undeletable through the normal Chrome interface.
• Malwarebytes documented this exact registry technique in June 2020, meaning Chrome is shipping a defense roughly six years after the abuse was publicly described.
• Chrome will record blocked extension IDs so repeat policy checks cannot reinstall them, will automatically uninstall affected extensions if a managed device loses trusted status, and will leave user installed extensions alone.

What Is the New Chrome Protection?

It is a feature flag called kBlockDseNtpOverrideExtensionsOnUnmanagedDevices that refuses to complete a policy driven install when the extension in question would take over the default search engine or the New Tab page. BleepingComputer first reported the work after spotting the associated changes in Chromium's code review system, where they remain under review rather than merged and shipped.

Google engineer Anunoy Ghosh gave the reasoning in the change description: "In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers." A system built so a school district could standardise ten thousand laptops has doubled as a malware persistence layer on machines that were never enrolled in anything. No Chrome version number has been announced, so treat this as a signal of direction, not a patch you are waiting on.

How Does Malware Fake an Enterprise Policy?

It writes the policy keys itself. Chrome on Windows reads its enterprise configuration from the registry, principally under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome, and it does not ask where those values came from. Any process running with sufficient privileges can create them. Google's own documentation for ExtensionInstallForcelist describes the intended behaviour plainly: listed extensions install silently, without user interaction, and the user cannot uninstall or disable them.

Supporting policies make it tidier. ExtensionInstallAllowlist exempts the extension from other restrictions, and ExtensionInstallSources permits an install from a server the attacker controls rather than the Chrome Web Store. The user opens the extensions page, finds the toggle greyed out and the remove button missing, and reads a tooltip saying the extension was installed by their administrator.

None of this is new. Malwarebytes described the identical registry manipulation in June 2020, down to the ExtensionInstallForcelist value format, and returned to the subject in 2022 when users reported removed extensions kept reappearing. Six years is a long time for a browser to keep repeating a lie on malware's behalf.

What Does a Search Hijacker Actually Earn?

Your queries, resold. A hijacked default search engine is not vandalism, it is a supply chain: the extension points the address bar at a relay the operator controls, that relay logs the query, appends affiliate parameters or its own ad units, and forwards you to a real search engine so the results look normal. You get answers. Somebody else gets the query stream and a cut of the ad revenue.

MalExt Sentry's SearchJack report catalogued 23 Chrome extensions running that exact model across roughly 758,000 users, marketed as satellite imagery viewers and productivity tools while the actual business was search affiliate revenue routed through at least eight separate monetisation brokers. The scale of extension based data collection is larger still: The Hacker News reported in December 2025 that a campaign tracked as ShadyPanda had turned popular extensions with 4.3 million combined installs into spyware over seven years.

A search history holds the symptoms you looked up before calling a doctor, the lawyer you priced, the job you considered. We have covered how a fake Perplexity extension quietly tracked every search its users made, and the same commercial logic drives the policy forced variant. The difference is that this one cannot be uninstalled.

What the Fix Does, and What It Leaves Alone

The change cancels the install outright rather than warning about it, then remembers the decision. Per BleepingComputer's reading of the Gerrit changes, Chrome records the blocked extension ID in a dedicated preference so the next policy refresh cannot quietly reinstall it. Those 2022 complaints about extensions reappearing after removal were exactly this loop, with the malware's policy key winning every reboot.

Four other behaviours are worth knowing:

• User installed extensions are preserved. An extension you chose that changes your New Tab page keeps working. The block targets the policy install path, not the capability.
• Loss of trusted management triggers uninstall. If a device was legitimately managed and stops being so, affected extensions are removed rather than grandfathered in.
• Real administrators get an escape hatch. A separate policy lets genuine enterprise deployments continue to force install search and New Tab extensions, so the change does not break managed fleets.
• Metrics ship alongside it. Chrome will count how often this fires, which is how Google will find out how common the abuse actually is.

Note the boundaries. The scope is search and New Tab overrides on unmanaged Windows and macOS, the platforms where a consumer machine reads local policy from a writable registry hive or plist. A force installed extension that never touches your New Tab page but reads every page you visit is still a policy install Chrome will happily perform. This closes a monetisation route, not the underlying trust assumption, and attacks that abuse other channels, such as the Edgecution chain from a malicious extension into native messaging, are untouched by it.

How Do You Check and Clean Your Own Machine Today?

Ask Chrome directly. Type chrome://policy into the address bar; on a personal machine that list should be empty. Anything under an extension policy heading, especially ExtensionInstallForcelist or ExtensionSettings, is a claim that somebody administers your computer. Then open chrome://extensions and look for entries labelled as installed by enterprise policy with no remove button. Google's Chrome Enterprise policy documentation explains what each policy name controls.

On Windows, run regedit and inspect these three locations, deleting only the entries you can attribute to the unwanted extension ID:

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
• HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Google\Chrome
• HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome

On macOS, check System Settings for an unexpected device management profile, then look for a stray com.google.Chrome plist under /Library/Managed Preferences or /Library/Preferences. Reading the output of defaults read com.google.Chrome against Chrome's macOS policy reference shows which keys are set and which you never asked for.

Two warnings. Deleting the key without removing whatever wrote it means the key comes back, so run a malware scan and check scheduled tasks and startup items in the same session. And do not do any of this on a work laptop, where those policies belong.

What This Means for Your Inbox

Anything installed through a policy key is installed with whatever permissions its manifest requests, and a great many extensions request access to every site you visit. Gmail, Outlook and Proton Mail are all just sites. An extension that sits inside your authenticated webmail tab can read message bodies, sender addresses and thread subjects with no additional exploit involved, because your browser already did the authenticating for it.

The removal barrier is what separates this from an ordinary bad extension. Something you installed by choice goes away in two clicks the moment you get suspicious. Something Chrome believes your administrator deployed does not, and most people faced with a greyed out toggle and an official sounding tooltip will decide the problem is unfixable and carry on reading their email with the thing attached.

Extensions occupy the same privileged position as the browser itself, which is why the LayerX findings on extensions selling browsing data landed as hard as they did. Audit the list you actually have, and be ruthless about the ones you no longer use.

Looking Ahead

Most coverage reads this as a New Tab annoyance fix. The better reading is that Chrome is starting to treat "your administrator installed this" as a claim to evaluate rather than a fact to obey, and that principle scales well past search hijackers. If local policy on an unmanaged device is untrustworthy for extension installs, it is untrustworthy for every other policy governing what the browser hides from you. Watch whether the Gerrit changes land and whether Google widens the scope. Until then, chrome://policy takes ten seconds to check, and on a machine you own the correct answer is a blank page.