"In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers," Anunoy Ghosh, who works at Google, wrote in a post.
Why Google is changing Chrome's handling of policy-installed extensions
Google is preparing a Chrome security feature designed to block extensions that are installed by policy when those extensions try to override the New Tab page or change the default search engine on unmanaged devices. The protection appears in a chain of work-in-progress Chromium Gerrit changes that were spotted by BleepingComputer and remain under review. Google plans to enable the feature by default once the changes are approved.
How attackers have been abusing enterprise policies
Chrome currently allows organizations to use enterprise policies to force-install extensions and to control browser settings. That mechanism works for properly managed enterprise devices tied to a domain or a mobile device management (MDM) system. But the same policy controls can be abused on consumer PCs: a malicious program can add local Chrome policy keys without the user's permission and force-install an extension that replaces the New Tab page, changes the search engine, or redirects searches to suspicious websites.
When that happens, Chrome may treat the extension as if an administrator installed it, which prevents users from removing or disabling it. In some instances Chrome also displays the confusing “Managed by your organization” message on machines that are not actually owned or managed by an organization.
What the proposed protection does, technically
The Gerrit changes enable a feature flag named kBlockDseNtpOverrideExtensionsOnUnmanagedDevices by default for unmanaged Windows and macOS devices, activating an end-to-end blocking defense for those environments. Under the proposed protection, Chrome would cancel attempts to install policy-controlled extensions that override the New Tab page or the default search engine.
When Chrome blocks such an installation it would record the extension ID in a blocked-extension preference, and Chrome would stop trying to download that same blocked extension during future policy checks — a step intended to prevent repeated installation attempts and unnecessary network activity. The code also prevents an extension a user installed manually from being converted into a locked, policy-controlled extension; it would remain under the user's control so it could still be disabled or removed.
Google will also automatically uninstall affected New Tab and search-engine override extensions if a device that was previously managed loses its trusted management status but still retains local policy keys.
Metrics, administrator controls, and an escape hatch
Google is adding metrics to measure how often policy-based hijackers appear and how frequently Chrome blocks them. The Gerrit changes include an administrative escape-hatch policy that allows legitimate administrators to disable the protection when a required enterprise extension needs to override the New Tab page or search engine for valid business reasons.
Those elements—telemetry and an explicit override for legitimate enterprise use—show the change is designed to balance detection and prevention on unmanaged devices while preserving functionality for true enterprise management scenarios.
What this means for end users, administrators, and adversaries
- End users: On unmanaged Windows and macOS machines, the proposed change would prevent policy-installed extensions from silently taking over the New Tab page or default search engine and reduce instances where Chrome shows “Managed by your organization” incorrectly.
- Enterprise administrators: Legitimate admins retain a documented escape hatch to disable the protection when necessary, and enterprise deployments that use domain or MDM-based trust should remain able to deploy required extensions.
- Adversaries and malware operators: The change targets the abuse vector where local policy keys are written and used to force-install hijacking extensions; blocked-extension preferences and halted re-downloads aim to make automated, repeated abuse more difficult.
The protection remains in Gerrit review and is not yet available in stable Chrome. If the changes are approved and Google enables the kBlockDseNtpOverrideExtensionsOnUnmanagedDevices flag by default, Chrome will begin canceling policy-driven attempts to override the New Tab page and default search engine on unmanaged consumer machines while recording and ceasing further download attempts for the blocked extension IDs. The next factual step to watch is whether the Gerrit review concludes with approval and default activation.
