Google is implementing a significant security enhancement in **Chrome** to combat a prevalent form of browser hijacking. The new feature will specifically block extensions that are force-installed via policy from altering the browser's New Tab page or default search engine. First spotted in **Chromium Gerrit** changes, this protection is currently in development but is slated for default activation once approved. **Anunoy Ghosh**, a Google engineer, highlighted the necessity of this feature, stating, "In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers."  ### Addressing Policy Abuse on Consumer PCs While enterprise policies for force-installing extensions are legitimate for managed work devices, malware has exploited this same mechanism on consumer PCs. Malicious programs can surreptitiously add local **Chrome** policy keys, leading to the installation of extensions that redirect searches, change the New Tab page, or alter the default search engine without user consent. These malicious installations often make the affected extensions appear as if they were installed by an administrator, preventing users from disabling or removing them. In some instances, **Chrome** may even display a misleading "Managed by your organization" message, despite the device being a personal, unmanaged computer. Google categorizes these consumer PCs as "low-trust" environments because **Chrome** is reading locally stored policies without validation from a trusted authority like a domain or Mobile Device Management (MDM) service. ### How the New Protection Works Under this proposed security measure, **Chrome** will actively block attempts to install policy-controlled extensions that try to override the New Tab page or default search engine. If such an attempt is detected, the installation will be canceled, and the extension's ID will be saved in a blocked-extension preference. This mechanism will also prevent **Chrome** from repeatedly attempting to download the same blocked extension during future policy checks, reducing unnecessary network activity. ### Combatting Additional Malware Tactics Google is also addressing another common malware tactic: converting user-installed extensions into locked, policy-controlled ones. With the new protection, extensions manually installed by users will remain under their control, allowing them to be disabled or removed at will. Furthermore, if a previously managed device loses its trusted management status but retains local policy keys, **Chrome** will automatically uninstall any affected New Tab or search-engine override extensions. To gauge the effectiveness of these new defenses, Google plans to add metrics to monitor the prevalence of policy-based hijackers and the frequency with which **Chrome** successfully blocks them. For legitimate administrators, an "escape-hatch" policy will be available, allowing them to disable this protection when a required enterprise extension legitimately overrides the New Tab page or search engine. The **Gerrit** changes are still undergoing review, and the feature is not yet available in the stable **Chrome** release.