Chrome prepares to block extensions that hijack your search engine and your home page
Google is working on a far-reaching change within Chromium that will directly affect one of the browser’s oldest abuses: extensions that, once installed, take over the new-tab page and the default search engine. According to the code under development, Chrome will block those modifications by default, instead of allowing them whenever the add-on has declared the corresponding permission. The measure is still in the testing phase, but it looks set to become one of the most visible security settings in the world’s most-used browser.
The move is no accident. Extensions have become one of the most profitable attack vectors against the end user: they require no operating-system vulnerability, they do not need to get past an antivirus and, above all, it is the user himself who installs them voluntarily and grants the permissions. A utility promising screenshots, discount coupons or a PDF converter is enough for millions of people to accept a dialog box without reading it.
What browser hijacking is exactly
The so-called browser hijacking does not necessarily involve a virus. It is software that alters the browser’s intended behaviour by exploiting legitimate permissions granted at installation. The usual pattern is always the same: the extension replaces the new-tab page with its own and redirects searches through an intermediary service. Every query then passes through a third party that monetizes the traffic through advertising or affiliate programs, while the user believes they are still using their usual search engine.
The consequences go beyond the annoyance. That intermediary can record the complete search history, correlate it with the IP address and the rest of the browser data, show unsolicited ads, inject sponsored results among the organic ones and even serve as a gateway for downloading other malicious components. In practice, an extension with broad permissions sees everything the user sees.
The problem of excessive permissions
The root of the matter lies in the permission model. Many extensions request access to “all websites” when their real function would only need to work on a single page. That excess, tolerated for years, is what allows an apparently harmless add-on to change critical settings or read the content of any tab. The transition to Manifest V3 already cut back some of those capabilities, but control of the new tab and the search engine remained open territory.
Added to this is a less obvious risk: the change of hands. An honest extension with an established user base is an asset with market value. When its developer sells it —or when their account is compromised—, the automatic update installs completely different code on thousands of machines without anyone having to accept anything new. The recent history of add-on stores is full of such cases.
Impact on companies and schools
The effect is not limited to the home user. In organizations and schools, where machines are often shared and add-on installation is not always restricted, a browser hijack can become a sustained data leak over time. System administrators have group policies to define whitelists of allowed extensions, block the rest and set the corporate search engine, but those policies remain underused in SMEs with no IT department of their own.
For those organizations, the Chrome change means a safety net by default: even if nobody has configured anything, the browser will resist an add-on altering key pieces of its configuration. It does not replace a well-defined extension policy, but it raises the minimum floor of protection.
What the user can do in the meantime
Until the measure reaches the stable channel, basic hygiene is worth applying: periodically review the list of installed extensions and uninstall those that are not used, check in the detail of each one what permissions have been granted and restrict access to “only on the sites I indicate” where possible, and distrust any add-on that demands changing the home page or the search engine to work. If searches are already being redirected to an unknown service, the first step is to review the active add-ons before reinstalling the browser.
Google’s initiative confirms an underlying trend in the industry: browsers are assuming that the user cannot correctly evaluate every permission they grant, and that security must come configured from the factory rather than depend on informed decisions. It is a late but necessary acknowledgement that the weakest link was never in the code but in a dialog box accepted in haste.
