Chrome Takes Aim at New Tab Hijackers
Google is developing a new browser-level protection for Chrome that would block policy-installed extensions from hijacking the New Tab page or altering the default search engine without explicit user consent. The feature targets one of the most persistent and frustrating tactics employed by adware distributors, potentially unwanted applications (PUAs), and low-quality extensions that monetize browser traffic.
According to reporting by BleepingComputer, the change is being developed as part of Chrome's ongoing efforts to strengthen the browser's default security posture and reduce the effectiveness of extension-based browser hijacking.
What Are New Tab Hijacker Extensions?
New Tab hijacker extensions are browser add-ons — often installed silently via software bundlers, enterprise group policies, or deceptive install flows — that replace Chrome's default New Tab page or the browser's default search engine with alternatives that generate advertising revenue for the extension developer.
These extensions commonly:
- Replace the New Tab page with a custom search portal or affiliate page
- Redirect search queries through alternative search engines that inject ads
- Use enterprise policy enforcement to prevent users from removing them
- Resist uninstallation through self-reinstall mechanisms
The behavior sits at the intersection of legitimate enterprise IT management (which uses policies to deploy browser extensions) and abuse by malicious actors who mimic those mechanisms.
The Proposed Protection
Google's proposed change would introduce a default-on restriction preventing policy-installed extensions — those deployed via enterprise Group Policy or similar mechanisms — from changing the New Tab page or default search engine without the user taking an explicit action to permit it.
This is significant because the policy installation pathway is frequently abused. Unlike extensions installed through the Chrome Web Store, policy-installed extensions bypass the normal user-visible install prompt. By restricting their ability to modify core browser defaults, Google would force any extension relying on this tactic to obtain genuine user consent.
The feature would not block all New Tab customization — extensions that users deliberately install from the Chrome Web Store and consciously configure would still be able to customize the New Tab experience.
Context: Chrome's Evolving Extension Security Model
This change is part of a broader trend in Chrome's security architecture. In recent years, Google has:
- Mandated Manifest V3 for all new extensions, restricting some categories of network-level content blocking used by malicious extensions
- Introduced enhanced safe browsing and extension warnings for potentially dangerous add-ons
- Expanded Chrome's Enhanced Protection mode to flag suspicious extension behavior
Browser hijacking through extensions remains one of the most common consumer-facing security complaints. Security vendors routinely report that browser modifier PUAs — software that alters homepage, search engine, or new tab settings — are among the top detection categories for endpoint protection products.
What This Means for IT Administrators
Organizations that legitimately deploy browser customizations through enterprise policies should monitor for this change. If Chrome enforces the new restriction, IT teams may need to ensure their extension deployments include proper user notification or configuration flags that satisfy Google's new consent requirements.
For enterprises running managed Chrome environments, this could require updates to Group Policy templates or Chrome Browser Cloud Management configurations to maintain expected extension behavior without triggering the restriction.
Takeaways
- Google is preparing a Chrome feature to block policy-installed extensions from hijacking New Tab pages and default search engines
- The change targets adware and PUAs that exploit enterprise policy install pathways to avoid user consent
- Legitimate enterprise deployments may need to review extension policies for compliance
- The feature is not yet released and details may change before it reaches stable Chrome