Chrome to block extensions that hijack new tab page

Anyone who's opened Chrome to a hijacked homepage and a baffling "Managed by your organisation" message on a personal computer may finally get relief.

Chrome lets organisations use enterprise policies to force-install extensions on managed work devices, a legitimate tool for domain-connected or MDM-controlled PCs.

This same method has been exploited by malicious software in order to silently install local policy keys to install the extension, which will then be able to take control of the New Tab page, change the default search engine and perform redirects to questionable websites.

Once installed, Chrome treats it as a controlled-by-the-administrator extension, and thus the user will not be able to remove or disable it. Sometimes, it will show a "Managed by your organisation" message despite there being no organisational management of the computer.

Google refers to this type of installation as a 'low-trust environment' because Chrome trusts the locally stored policies regardless of whether an actual trusted source like a domain or MDM service is involved.

The fix, still under Chromium Gerrit review, enables a feature flag called kBlockDseNtpOverrideExtensionsOnUnmanagedDevices by default. Google's Anunoy Ghosh described the change as an "end-to-end blocking defence" for unmanaged Windows and macOS devices.

With Chrome activated, it will block the installation of policy-controlled extensions trying to change the New Tab or search engine page and record the extension ID as well as stop trying to install the extension again.

In the case that devices lose their trusted status but retain some policy keys, those extensions will be deleted.

The feature is not available in the stable version of Chrome yet, and Google has not announced any version or date of release. In the meantime, people who think that their New Tab or search engines have been compromised may enter "chrome://policy" into the address bar to check for unusual policies, analyse any admin-installed extension, scan using an appropriate anti-malware tool, and delete the extension and its policy keys simultaneously.