You open a new browser tab expecting a clean start page. Instead, you're staring at an unfamiliar search box, a wall of "recommended" articles you never asked for, and a search engine you're certain you never chose. Your homepage changed too. Somewhere along the way, a piece of software quietly rewrote how your browser behaves, and now it's serving you ads and skimming your search queries.
This is a browser new tab hijack, and it's far more common than most people realize. According to multiple threat-intelligence reports over the past few years, browser hijackers and adware consistently rank among the top three most-detected "potentially unwanted programs" (PUPs) on Windows machines. One reason: they aren't technically viruses. They ride in on the back of free installers, get a checkbox buried in an install wizard, and become legally gray software that antivirus tools sometimes leave alone.
In this guide I'll walk you through exactly how these hijacks work, how to remove one step by step (with real menu paths), how to tell a legitimate new-tab extension from a parasitic one, and how to lock your browser down so it never happens again. I've cleaned dozens of these off client machines, and the same five or six patterns show up every time.
Key Takeaways
- New tab hijacks almost always arrive bundled with free software. The fix starts with uninstalling the host program, not just the extension.
- Removing the visible extension is only step one. Hijackers plant policies, scheduled tasks, and shortcut modifications that reinstall themselves.
- Check your browser's
Managed by your organizationbanner. If it appears on a personal machine, malware set an enterprise policy.- A legitimate new-tab tool discloses its data practices, lets you remove it cleanly, and doesn't change your default search without asking.
- Prevention beats cleanup: verify downloads, decline bundled offers, and audit extension permissions quarterly.
What a browser new tab hijack actually is
A new tab hijack is any unauthorized change to your browser's new-tab page, homepage, or default search engine, usually made by software you didn't intend to install. The goal is almost always money. Every search you run through the hijacked engine, and every ad you see on the fake new-tab page, generates revenue for whoever planted it.
These changes are enforced through several mechanisms working together:
- Browser extensions that override the new-tab page using the
chrome_url_overridesmanifest key. - Enterprise policies written to the Windows registry or macOS profiles that lock your search engine so you can't change it back.
- Modified shortcuts where the browser's target line appends a URL, so every launch reopens the hijacker page.
- Companion programs installed alongside, running in the background, that re-apply the hijack if you remove the extension.
That last point is why so many people "fix" the problem and watch it return the next day. You have to pull the whole plant out by the roots.
How you got it in the first place
In my experience cleaning these up, the origin is almost always one of three things:
- A free utility (PDF converter, video downloader, "driver updater," free game) whose installer offered a bundled "search enhancer" with the box pre-checked.
- A browser extension that started life as something useful, then sold to a new owner who pushed a malicious update.
- A fake installer downloaded from a search ad or a mirror site posing as the real product.
That third route is preventable with a little discipline. Our walkthrough on how to verify software downloads and avoid fake installers covers checksum verification and signature checks that catch tampered files before they ever run.
How to remove a new tab hijacker step by step
Here's the full removal sequence. Do these in order. Skipping the uninstall step and going straight to the extension is the number-one reason people fail.
Step 1: Uninstall the host program
On Windows, open Settings > Apps > Installed apps. Sort by install date. Look for anything you don't recognize installed around the time the trouble started, plus obvious culprits like "Search Manager," "Web Companion," "PC Optimizer," or any name with the word "search" or "protect" you didn't intentionally buy. Uninstall them.
On macOS, open Finder > Applications, and drag suspicious apps to the Trash. Then check System Settings > General > Login Items for background helpers.
Step 2: Remove the malicious extension
In Chrome, go to chrome://extensions. In Edge, edge://extensions. In Firefox, about:addons. Toggle off and then Remove anything unfamiliar, especially items that mention search, new tab, coupons, or weather.
If an extension has a message saying "Installed by enterprise policy" and no remove button, note its ID. You'll strip the policy in Step 4.
Step 3: Reset your search engine and startup pages
In Chrome, open Settings > Search engine > Manage search engines. Delete the hijacker entry and set Google, Bing, or DuckDuckGo as default. Then under On startup, remove any injected URL. Repeat for the new tab and homepage settings.
Step 4: Delete enterprise policies (the sneaky part)
Visit chrome://policy. If you see policies like HomepageLocation, DefaultSearchProviderSearchURL, or NewTabPageLocation on a personal computer, malware set them. On Windows, remove the corresponding registry keys under:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\ChromeHKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome- The equivalent
\Microsoft\Edgepaths
After editing, reboot and revisit chrome://policy to confirm the entries are gone. On macOS, check System Settings > Privacy & Security > Profiles and remove any unknown configuration profile.
Step 5: Repair modified browser shortcuts
Right-click your browser shortcut, choose Properties, and inspect the Target field. It should end with chrome.exe" or msedge.exe" and nothing after it. If a URL is appended, delete everything after the quotation mark. Check pinned taskbar and Start menu shortcuts too, since they're separate files.
Step 6: Kill scheduled tasks and startup entries
Open Task Scheduler and Task Manager > Startup apps. Disable anything that re-launches the removed program. Hijackers commonly plant a task that runs every hour to "repair" the settings you just fixed.
Step 7: Scan and verify
Run a reputable on-demand scanner, then restart and open a fresh tab. If your clean start page holds through a reboot and a full day of use, the roots are out.
A real before-and-after cleanup
Let me put numbers on this. A client called me after installing a free PDF-to-Word converter he found through a search ad. Here's what the machine looked like on arrival:
- 3 unknown programs installed within the same 90-second window as the converter.
- 2 browser extensions he never added, both with "Read and change all your data on all websites" permission.
- Default search changed to an unfamiliar engine, locked by 4 enterprise policies.
- A scheduled task firing every 60 minutes to reset those policies.
- His Chrome, Edge, and taskbar shortcuts all had
?q=...URLs appended to the target.
He'd tried three times to "fix" it by just changing the search engine back. It reverted within an hour every time, because the scheduled task and policies were still live.
The actual repair took about 25 minutes following the seven steps above. The critical move was deleting the scheduled task before the policies, so nothing re-applied them. After a reboot, chrome://policy showed zero entries and the new tab has been clean for months. Total cost: nothing but time and the lesson to stop clicking search ads for free software.
Legitimate new tab tools vs hijackers: how to tell them apart
Not every custom new-tab page is malware. Plenty of people install tab dashboards on purpose. The difference comes down to transparency, consent, and how cleanly the tool removes. Here's how the categories stack up.
| Trait | Legit new-tab tool | Aggressive adware | Outright hijacker |
|---|---|---|---|
| How it installs | You choose it from a store | Bundled, box pre-checked | Silent, no consent |
| Changes default search | Only if you opt in | Yes, with a dismissible prompt | Yes, and locks it via policy |
| Uninstall behavior | Clean, one click | Leaves leftovers | Reinstalls itself |
| Data disclosure | Clear privacy policy | Vague or buried | None |
| Permissions requested | Minimal, scoped | Broad | Read all data everywhere |
The single fastest tell is the permission line and the enterprise-policy lock. A legitimate tool never needs to prevent you from changing your own search engine. If you want a deeper framework for judging extensions before you trust them, our piece on the security risks of AI browser extensions and safer alternatives lays out a permission-audit routine you can apply to any add-on.
How to prevent a browser hijack from happening again
Cleanup is satisfying, but prevention is where you actually win back your time. These habits stop the vast majority of hijacks at the door.
Slow down during installs
Choose Custom or Advanced install every time it's offered, and read each screen. Bundled offers hide behind Next-
Cover image: iPhone firmware/software update 1.0.1 by Schill, licensed under BY 2.0 via Openverse.
