How to Report a Malicious Chrome Extension to Google

If an extension is stealing data, injecting ads or pretending to be something it's not, reporting it helps Google remove it for everyone. Protect yourself first, then report.

Step 1: protect yourself

1. Go to chrome://extensions and remove the extension.
2. Check your search engine, homepage and new tab settings, and reset any that changed.
3. If the extension could read all sites, change passwords for important accounts, sign out of other sessions, and turn on two-step verification.
4. Run Settings → Privacy and security → Safety Check.

Step 2: report it

• When removing it: right-click the extension's icon in the toolbar and choose Remove from Chrome. The confirmation box has a Report abuse checkbox. Tick it and you're taken to the report form.
• From the Web Store: open the extension's page on the Chrome Web Store and use its report option (labeled "Report abuse" or shown as a flag) to choose a reason and add details.

Pick the reason that fits best: malware, phishing, spam, unwanted ads, impersonation, or a privacy policy it doesn't follow.

What to include

• What happened and when it started, for example after an update.
• What you saw: redirects, new ads, changed settings, or pages asking for logins.
• The extension's exact name, its developer and its version, from chrome://extensions → Details.
• Whether it copies a well-known extension's name or icon.

Specific details make a report easier to act on than "this is malware".

Watch for copycats

Fake extensions often copy the names of popular ones, or promise features people search for, such as dark mode for a specific app or a free version of a paid tool. Before installing, check the developer name, the number of users, recent reviews and the permissions requested. See how to test an extension before trusting it.

Other places to report

• A phishing site the extension sent you to: report it through Google Safe Browsing's report page.
• Money lost or accounts taken over: contact your bank right away, and in the US, report it at reportfraud.ftc.gov.
• At work: tell your IT team, who can block the extension for everyone.

To check whether an extension you like has changed hands, see how to check if an extension was compromised or sold.