Chrome Blocking New Tab Hijacker Extensions? Not Yet (2026)

Chrome does not block new-tab hijacker extensions yet. Google is building a flag, kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, to stop policy-installed extensions from overriding your new tab page or search engine on unmanaged Windows and macOS devices. As of August 2026, the code sits under review in Chromium’s Gerrit, not in any shipped Chrome build.

Key takeaways

• Not shipped. The flag exists as a Gerrit change under review (cl/8165095); Chrome 151 stable has none of this behavior.
• Narrow target. It blocks policy-installed extensions on unmanaged Windows/macOS devices, not extensions you install yourself from the Chrome Web Store.
• The exploit it closes: malware plants fake local policy keys so Chrome believes an extension was force-installed by an employer, making it undeletable.

What the New Chrome Flag Actually Blocks

kBlockDseNtpOverrideExtensionsOnUnmanagedDevices is a feature flag currently moving through Chromium’s Gerrit code review, first reported publicly by BleepingComputer. Its job, once merged and enabled, is narrow and specific: prevent policy-installed extensions from changing the new tab page (DSE and NTP in the flag name stand for default search engine and new tab page) on devices Chrome does not recognize as enterprise-managed.

That scoping matters more than the headline. This isn’t a general crackdown on extensions that customize your new tab page — it targets one delivery mechanism: extensions installed through Chrome’s enterprise policy system on a machine that isn’t actually enrolled in any enterprise.

The Fake-Enterprise Trick This Closes

The abuse pattern is specific enough that Google engineer Anunoy Ghosh described it directly: “In low-trust environments (unmanaged consumer devices), enterprise policy force-installs and recommendations are abused to lock in search engine or new tab page hijackers.”

Here’s how that plays out on a real machine. Chrome checks local policy keys (registry entries on Windows, plist-style config on macOS) to decide whether a device is managed by an organization. Malware writes those keys directly, without ever touching a real IT department or an MDM console. Chrome sees the keys, concludes the machine is enterprise-managed, and force-installs whatever extension the fake policy names. The card in chrome://extensions shows “Managed by your organization.” The uninstall button doesn’t work, because Chrome treats admin-mandated extensions as something the user isn’t supposed to remove.

The user never approved anything. They never saw a Chrome Web Store listing, a permission prompt, or a review. The malware skipped every consent step Chrome normally requires by faking the one category of installation Chrome trusts without asking.

What Still Gets Through

Even after this flag ships, several adjacent problems stay exactly as they are today.

The last row is worth sitting with. Extensions that hijack search settings or the new tab page after a user installed them voluntarily, because the listing looked legitimate or a bundled installer slipped one in during setup, are unaffected by this change entirely. This flag closes one specific door: the policy-key one. It says nothing about which extensions deserve your trust in the first place.

When Might This Actually Ship

There’s no committed date. Chromium features that reach Gerrit review can land within weeks, sit for months while reviewers request changes, or get abandoned if the security team decides on a different approach. kBlockDseNtpOverrideExtensionsOnUnmanagedDevices is a feature flag, which usually means a staged rollout (dev and canary channels first) rather than an instant stable-channel switch even after the code merges.

The honest read for August 2026: this is a real, named, in-progress fix for a real attack pattern Google has documented, not a shipped protection. Treat any headline claiming Chrome “now blocks” hijacker extensions as premature until it shows up in stable release notes.

Check for a Hijacker on Your Machine Right Now

Since the automatic block isn’t live, checking manually still falls to you.

1. Open chrome://extensions and look for anything you don’t recognize, especially a card labeled “Managed by your organization” if you don’t work for a company that manages your browser.
2. Open chrome://policy and scan for policy sources you didn’t set. A personal machine should show no active enterprise policies at all.
3. If you find a fake-managed extension, removing the underlying registry or plist policy keys is the current fix; toggling the extension off in chrome://extensions alone often won’t hold, since the fake policy re-forces it.
4. If cleanup fails or the keys keep reappearing, a clean Chrome profile or OS-level malware scan is the next step, since the policy keys are usually planted by something broader than the extension itself.

If You Want a New Tab You Chose, Not One Forced On You

The distinction this Chrome flag draws, installed-by-you versus installed-by-a-lie, is the same line worth applying to your own extensions today, before Google’s fix exists to enforce it. SuperchargeNavigation’s new tab page is a Chrome Web Store install you can see, review, and remove from chrome://extensions in one click, any time. No policy keys, no fake management claims, no undeletable state. Its optional new tab page shows your workspaces, pinned tabs, and top sites, with a search box for jumping to any open tab, bookmark, or history entry without hunting through menus.

If your new tab page changed and you never touched an extension’s options page, start with the two checks above before assuming it’s a bug. If you’re choosing a new tab replacement on purpose, choose one you can verify does exactly what its listing says, and nothing you didn’t agree to underneath it.