Chrome moves to block policy-installed extension hijackers

Enterprise policy is the most trusted install path a browser has, and that's exactly why it gets abused. Chromium is now working on a defense: a feature flag that blocks policy-installed extensions from overriding the New Tab page or the default search engine on unmanaged devices. If you run a small fleet, this Chrome extension change is a good excuse to look at what's actually force-installed on your team's laptops.

What actually happened

BleepingComputer spotted the work moving through Chromium's code review. The flag is kBlockDseNtpOverrideExtensionsOnUnmanagedDevices, and the change enables it by default on unmanaged Windows and macOS devices. The commit's own reasoning is direct: in low-trust environments, enterprise force-install and recommendation policies get abused to lock in search engine and new tab page hijackers.

Mechanically, Chrome cancels the install of a policy-controlled extension that overrides DSE (default search engine) or NTP (new tab page), records the extension ID in a blocked-extension preference so repeat policy checks don't retry it, and uninstalls affected extensions if a managed device loses trusted status. Legitimately managed enterprises get an escape-hatch policy for extensions they genuinely require.

This has not shipped to stable Chrome. It's under review, no version number attached. Treat it as direction, not a date.

Why browser extension policy matters for your business

The abuse here is clever and worth understanding, because the same mechanism runs on your machines. ExtensionInstallForcelist installs extensions silently, with no user interaction, and the user cannot remove or disable them through Chrome's UI. Permissions are granted implicitly. That's a legitimate admin tool — and to malware that can write registry keys or a config profile, it's a persistence mechanism with a Google-blessed install path.

Most small businesses have never audited this. Nobody set the policy on purpose; something else did, or an MSP set it three vendors ago and never removed it. Meanwhile the browser is where the actual work happens now — your CRM, your admin panels, your email, your AI assistants. An extension with broad host permissions reads all of it.

Do this on your own fleet this week, no tooling required. Open chrome://policy on a few machines and read the extension policies that are actually applied — not the ones you think you set. Then open chrome://extensions and look for anything marked "Installed by enterprise policy" that you can't name the reason for. On the AI side specifically: browser agents and assistant extensions ask for permission to read and change data on every site, which is the whole point of them and also the entire risk. Grant those per-site where the extension supports it, and keep a written list of which ones your team is allowed to install.

Google shipping a default-on block is useful. It also only covers two hijack targets — search and new tab. Everything else an extension can do to your session is still up to you.

Sources: BleepingComputer, Chrome Enterprise policy docs.