Chrome Prepares to Block New-Tab Hijacker Extensions

Google is working on a protective mechanism for Chrome that will, by default, block extensions installed via enterprise policies if they try to hijack the new tab page or change the default search engine. BleepingComputer spotted the relevant changes in the status of drafts in the Chromium Gerrit system. The feature hasn't shipped yet, but Google plans to enable it by default once the edits are approved.

What's the problem

Right now, Chrome lets organizations use enterprise policies to force-install extensions and manage browser settings. On managed work devices joined to a domain or a mobile device management (MDM) system, there's nothing wrong with that. However, malware has long exploited the same mechanism on ordinary home computers.

Malware can add local Chrome policy keys without the user's knowledge and force-install an extension that replaces the new tab page, changes the search engine, or redirects queries to suspicious sites. In doing so, Chrome assumes the extension was installed by an administrator, which makes it impossible to remove or disable. Sometimes the browser even shows the confusing message “Managed by your organization,” even though the computer belongs to no one but its owner.

Google employee Anunoy Ghosh explains that such consumer PCs are considered a “low-trust environment”: Chrome reads the locally stored policies without confirmation from a trusted source — a domain or an MDM service.

How the protection will work

A new flag with the telling name kBlockDseNtpOverrideExtensionsOnUnmanagedDevices activates end-to-end protection on unmanaged Windows and macOS devices. Chrome will cancel the installation of extensions that try to override the new tab page or search engine through policies, and will save their identifiers in a blocklist. Repeated attempts to download the same extension during subsequent policy checks will stop — which, as a bonus, will spare some unnecessary network activity.

Google is also closing a related loophole. An extension installed manually by the user will no longer turn into a locked “managed” one — it will stay under the owner's control, and it can be disabled or removed. And if a previously managed device loses its trusted status while the local policy keys remain, Chrome will automatically remove the affected hijacker extensions.

For legitimate administrators there is an “escape hatch” — a separate policy that disables the protection if a needed corporate extension really does require overriding the new tab page or search engine. Google is also adding metrics to track how often such hijackers appear and how successfully the browser blocks them.

The edits are still under review, so the feature isn't yet available in the stable version of Chrome.

Source: Bleeping Computer