Chrome will soon block the malware trick that locks your New Tab page hostage

Google is working on a fix for one of Chrome’s oldest malware headaches. A series of Chromium commits, first spotted by BleepingComputer, shows the company building protections against browser hijackers that abuse enterprise policies to lock users into unwanted New Tab pages or search engines.

Enterprise policies are meant for organizations that manage Chrome across multiple devices. They let administrators install extensions and enforce browser settings. Malware has been exploiting the same system on consumer PCs by creating local policy entries that make Chrome believe the browser is being managed by an administrator. That’s why some infected users end up seeing the familiar “Managed by your organization” message even though they own the computer.

Google calls these consumer systems “low-trust” environments because Chrome has no reliable way to verify whether those local policies came from a legitimate administrator.

The upcoming change will stop Chrome from force-installing extensions through enterprise policy on unmanaged Windows and macOS devices if they’re trying to take over the New Tab page or default search engine. Chrome will also block those extensions from being reinstalled during future policy checks.

According to one of the Chromium commits, enterprise policy force-installs on unmanaged devices have become a common way to lock users into search engine and New Tab hijackers.

The protection doesn’t just stop new infections. If a computer was previously managed but later becomes unmanaged, Chrome can automatically remove policy-installed hijacker extensions left behind by those old policies. Extensions installed by the user won’t be affected.

Google has been steadily adding more security improvements to Chrome lately. The browser recently gained a built-in option to report harmful websites directly from the Help menu, making it easier to flag suspicious pages without leaving Chrome.

The company has also been using AI to help engineers identify and fix bugs faster, contributing to more than a thousand fixes across two recent Chrome releases.

Elsewhere, Google is testing Global Privacy Control support and redesigned camera and microphone permission prompts, both of which aim to give users more control over their browsing experience.

The new anti-hijacking protection is still being developed, so it hasn’t reached Chrome Stable yet. Google is also adding an enterprise policy that lets organizations disable the safeguard when they legitimately need extensions to modify the New Tab page.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.