How to Tell if Your Chrome Browser Has Been Hijacked

A browser hijacker changes Chrome's settings without asking, usually to send your searches through its own pages and show you ads. It typically arrives with free software, a fake download or a malicious extension.

Signs Chrome has been hijacked

• Your search engine changed, or searches pass through an unfamiliar site before showing results.
• Your homepage or new tab page changed and keeps changing back.
• Extensions you don't remember installing.
• Pop-ups, ads or redirects on sites that don't normally have them.
• Lots of notifications from sites you don't recognize.
• Chrome's menu says Managed by your organization on a personal computer.

How to fix it

1. Remove unknown extensions: open chrome://extensions and remove anything you don't recognize or need.
2. Fix your search engine: Settings → Search engine, choose yours, and delete unfamiliar ones under Manage search engines.
3. Fix start-up pages: Settings → On start-up, and remove pages you didn't add.
4. Remove notification permissions: Settings → Privacy and security → Site settings → Notifications.
5. Reset Chrome: Settings → Reset settings → Restore settings to their original defaults. This disables extensions and clears temporary data, but keeps bookmarks and saved passwords.

If it keeps coming back

• Uninstall the software it came with. On Windows, go to Settings → Apps and sort by install date; remove anything unfamiliar from around when the problem started.
• Check policies. Open chrome://policy. On a personal computer there should usually be nothing listed. Unknown policies that force a search engine or extensions point to unwanted software.
• Check your Chrome shortcut. Right-click it → Properties. If a web address has been added after chrome.exe in the Target box, remove it.
• Run a full scan with Microsoft Defender or another reputable antivirus.

After you've cleaned up

• Run Chrome's Safety Check (Settings → Privacy and security) to find harmful extensions and compromised passwords.
• Change your important passwords if the hijacker was installed for a while.
• Turn on Enhanced protection under Security.

Avoid it next time

• Download software only from the official site, and choose Custom install to untick bundled extras.
• Be wary of extensions offered by pop-ups or "required" to view a page.
• Ignore fake update and virus warnings. See fake Chrome update popups.

A related attack, clipboard hijacking, swaps what you copy, such as a crypto wallet address. See clipboard hijacking explained. Clipboard Guard stops sites from reading your clipboard without permission.