Google Chrome to Block Malicious New Tab Hijackers by Default

Google is preparing to roll out a significant security enhancement to its Chrome browser, designed to thwart malicious extensions that hijack the New Tab page or change the default search engine. This new feature, spotted in development within Chromium Gerrit changes, aims to protect users, particularly on unmanaged consumer devices, from unwanted browser modifications.

The core of the problem lies in how Chrome's enterprise policies are abused. While legitimate for managed work environments, these policies can be exploited by malware on personal computers. Malicious actors can inject local Chrome policy keys without user consent, forcing the installation of extensions that can then take over the New Tab experience, redirect search queries, or point users to fraudulent websites. Chrome, mistakenly believing these extensions were administrator-approved, would then prevent users from removing or disabling them, often accompanied by the misleading "Managed by your organization" banner.

To combat this, Google plans to enable a feature flag, tentatively named kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, by default. This will activate a comprehensive blocking mechanism on unmanaged Windows and macOS devices. When an attempt is made to install a policy-controlled extension that overrides the New Tab page or default search engine, Chrome will cancel the installation. The extension's ID will be recorded in a blocked-extension preference list, preventing future installation attempts during policy checks and reducing unnecessary network activity.

Beyond blocking new installations, the update addresses existing compromises. Extensions that were manually installed but subsequently locked down by malicious policies will remain under user control, allowing them to be disabled or removed. Furthermore, if a device loses its trusted management status but still retains local policy keys, Chrome will automatically uninstall any affected New Tab or search-engine override extensions.

Google is also implementing metrics to track the prevalence of these policy-based hijackers and the effectiveness of the new blocking feature. This data will help refine the protection and understand the threat landscape. Recognizing that legitimate administrators might need to override these settings for specific enterprise extensions, Google is including an "escape-hatch" policy that allows administrators to disable the protection when necessary.

While the changes are still under review and not yet available in the stable Chrome release, their planned default activation signifies Google's commitment to enhancing user security against common browser manipulation tactics. This proactive measure aims to restore user control and prevent malicious actors from exploiting browser management features on consumer devices.