Block New Tab Hijacker Extensions in Chrome (2026)

You open a new tab expecting Google or your carefully curated speed-dial page, and instead you get a knockoff search box crammed with sponsored links, a weather widget you never asked for, and a URL that reads like search.somethingweird.co. That is a new tab hijacker at work, and if it has happened to you, you are in a very large club. Browser telemetry from multiple security vendors in 2025 consistently pegged new-tab and search hijackers as one of the top three most common unwanted-software complaints, ahead of most classic adware.

Here is the part that surprises people: most of these hijackers are not "viruses" in the traditional sense. They are Chrome extensions you installed on purpose, often bundled with something genuinely useful like a coupon finder, a PDF converter, or a screen recorder. The extension asked for permission to "read and change your data on all websites" and to "change your search settings," you clicked Add extension, and that was the whole heist.

In this guide I will show you exactly how to block new tab hijacker extensions in Chrome, how to remove ones already dug in, and how to lock the browser down so the next sketchy extension never gets the chance. I use these techniques on my own machines and on the family fleet I quietly maintain, so this is the practical version, not the marketing version.

Key Takeaways

New tab hijackers are almost always extensions with the tabs and search-override permissions, not malware in the classic sense.

The fastest fix is chrome://extensions plus a hard reset of your new tab and search settings.

Chrome's Enterprise policies (via ExtensionInstallBlocklist and ExtensionInstallAllowlist) let you block hijackers before they install, even on a single home PC.

Force-installed extensions that reappear after removal are controlled by policy or another app, and need a different removal path.

Vetting an extension's permissions and publisher before installing prevents 90% of hijacks.

A layered approach, browser hardening plus endpoint hygiene, beats any single toggle.

What Exactly Is a New Tab Hijacker Extension?

A new tab hijacker is a browser extension that overrides one or more of these three things: your new tab page, your default search engine, and sometimes your homepage. It does this through legitimate Chrome APIs, which is why antivirus software often ignores it. The extension is doing exactly what it declared it would do; you just did not read the fine print.

The business model is simple. Every hijacked search you run gets routed through an affiliate feed, and the extension author earns a fraction of a cent on the ads shown. Multiply that by a few hundred thousand installs and you have a lucrative operation that has every incentive to make itself hard to remove.

The three permission red flags

"Change your search settings to: [some domain]" — the clearest signal. Legitimate productivity extensions rarely need this.
"Read and change all your data on the websites you visit" — broad host access, needed by ad injectors.
"Replace the page you see when opening a new tab" — the literal hijack, declared in the manifest via chrome_url_overrides.

If you want a deeper framework for evaluating these prompts, I wrote a companion piece on how to vet browser extensions before granting AI permissions that applies just as well to search and tab access.

How to Tell If Your Chrome Is Already Hijacked

Before you start ripping out extensions, confirm which one is guilty. Here is the diagnostic I run, and it takes about two minutes.

Open a new tab. Note the exact URL that loads in the address bar. If it is anything other than Google's new tab page or a page you deliberately set, write it down.
Go to Settings → Search engine → Manage search engines and site search. Look at your default. If it is a name you do not recognize, that is your hijacker's payload.
Go to Settings → On startup. Check whether a strange page has been added to "Open a specific page or set of pages."
Open chrome://extensions and scan for anything you did not intentionally install, especially recently added items.

A worked example

Say your new tab now loads feed.searchgardenhq.com, your default search is "Garden Search," and you have three extensions installed: a legit ad blocker, a note clipper you use daily, and something called "Quick PDF Convert Plus" you added last Tuesday. The note clipper and ad blocker are years old and never caused trouble. The PDF tool arrived the same week the hijack started. That timing correlation is your suspect. In roughly 8 out of 10 cases I have handled, the newest unfamiliar extension is the culprit.

To confirm without guessing, disable "Quick PDF Convert Plus" using the toggle, then open a fresh Chrome window. If the new tab returns to normal, you have your answer. Chrome will often show a banner asking whether you want to restore your original settings the moment you disable the offending extension.

How to Remove a New Tab Hijacker Extension (Step by Step)

This is the manual cleanup. Do this first even if you plan to add policy-level blocking later.

Type chrome://extensions in the address bar and press Enter.
Toggle Developer mode on (top right). This reveals each extension's ID, which you will need for policy blocking later.
Find the hijacker. Click Details, scroll to Permissions, and confirm it lists search or new-tab override.
Click Remove, then confirm. If prompted, also tick "Report abuse" to help Google flag it.
Go to Settings → Search engine and set your default back to Google (or your preferred engine). Delete the hijacker's entry from the managed list.
Go to Settings → On startup and remove any injected startup page.
Open a new tab to verify it loads clean.
Restart Chrome completely so no background service pages linger.

When the extension will not stay removed

If the extension reappears after you remove it, or the Remove button is greyed out with a note like "Installed by your organization" or a small building icon, you are dealing with a force-installed extension. That means something on your system, either a leftover policy or a companion desktop app, keeps reinstalling it. You cannot fix this from the extensions page alone. Skip to the policy section below.

How to Block New Tab Hijacker Extensions Before They Install

Removal is reactive. Blocking is proactive, and it is far more powerful. Chrome respects a set of enterprise policies even on a plain home installation, and you do not need a domain, a server, or a Google Workspace license to use them. This is the single most effective control most people never touch.

Option 1: Windows Registry (no extra software)

On Windows, Chrome reads policy from the registry. To block a specific extension by ID:

Get the extension's ID from chrome://extensions with Developer mode on (a 32-character string like abcdefghijklmnopabcdefghijklmnop).
Press Win + R, type regedit, and open the Registry Editor.
Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist. Create the keys if they do not exist.
Add a String value named 1 with the extension ID as its data.
To block everything and allow only what you trust, set the same path's ExtensionInstallBlocklist value 1 to *, then add trusted IDs under ExtensionInstallAllowlist.
Restart Chrome. Visit chrome://policy to confirm the policy is applied.

The wildcard approach (* in the blocklist plus a short allowlist) is what I run on machines I set up for relatives. It means no extension can install unless I explicitly permit it, which kills the hijacker problem at the root.

Option 2: macOS and Linux

On macOS you push the same policy via a configuration profile (a .mobileconfig targeting com.google.Chrome) or a plist under /Library/Managed Preferences/. On Linux you drop a JSON file into /etc/opt/chrome/policies/managed/. The key names, ExtensionInstallBlocklist and ExtensionInstallAllowlist, are identical across platforms.

Option 3: Chrome's built-in guardrails

Simpler, if less airtight: go to Settings → Privacy and security → Safety check and run it. Then enable Enhanced Safe Browsing under the same menu. Enhanced mode warns you about risky extensions and known malicious download sources before they land. It will not catch every affiliate hijacker, but it raises the floor.

Comparing Your Options for Blocking Hijackers

There is no single "best" method; it depends on how locked-down you want to be and how much friction you will tolerate. Here is how the main approaches stack up.

Method	Blocks before install?	Setup effort	Survives reinstall?	Best for
Manual removal	No	Low (2 min)	No	One-off cleanup
Enhanced Safe Browsing	Partial	Low	N/A	Casual users
Blocklist by ID (policy)	Yes	Medium	Yes	Known repeat offenders
Allowlist-only (policy)	Yes	Medium	Yes	Family/managed PCs
Endpoint hygiene tools	Yes	Medium-High	Yes	Whole-system defense