How to Find and Remove Malicious Chrome Extensions

First decide whether this is nuisance, compromise or policy

Common warning signs include search or homepage changes you didn't make, redirects, new ads, unfamiliar extensions, repeated permission prompts, a disabled Remove button, unknown “installed by enterprise policy” labels or login alerts from accounts used in the browser. Google's unwanted software guidance lists persistent pop-ups, hijacked browsing and extensions that keep returning among the signs.

On a work or school computer, policy may be legitimate. Contact the administrator before removing managed software. On a personal computer that has never been managed, an unknown forced-install policy is a persistence warning.

Remove a suspicious Chrome extension

1. Open the extension manager. Type chrome://extensions in the address bar. This avoids following a potentially altered menu or search result.
2. Disable the extension. Turn its toggle off first so it stops acting while you document the entry.
3. Open Details. Record the extension ID and review “site access.” A simple tool requesting access to all sites deserves particular scrutiny.
4. Select Remove and confirm. Google's official install and manage extensions guide documents the same path.
5. Restart Chrome and check again. Return to chrome://extensions. If the item returns, move to the policy and operating-system steps below.

Don't reinstall immediately from the store. First confirm the publisher and why the add-on appeared. A copied icon and near-identical name aren't proof of the same product.

If the extension comes back or can't be removed

1. Open chrome://policy. On a personal unmanaged device, look for forced-extension or unfamiliar browser policies. Record policy names and values.
2. Check the browser's management status. An unexpected “managed by your organization” message can be caused by security software, unwanted software or system policy; the label alone doesn't identify which.
3. Review installed applications. Remove an unfamiliar program installed at the same time, using the operating system's normal app-uninstall interface.
4. Run updated malware scans. A program on the computer may be restoring the extension or policy.
5. Recheck after reboot. Confirm that both the extension and unwanted policy are gone before using accounts normally.

Assume broad browser access may have exposed account data

An extension with permission to read and change data on all sites may have seen page contents, form data or active sessions, depending on its code and browser controls. Removing it stops future access; it doesn't invalidate information already copied.

1. Move to a known-clean device. Don't type replacement passwords into the suspected browser.
2. Secure the Google account. Review devices and recent security activity, sign out unknown or all sessions as appropriate, and remove unfamiliar connected apps.
3. Secure primary email and password manager. They can reset many other accounts. Review recovery methods, app passwords and forwarding rules.
4. Rotate accounts used while the extension was active. Prioritise banking, work, social advertising, shopping and crypto.
5. Reset MFA and trusted devices if access is suspicious. Add a passkey or hardware security key where supported.
6. Terminate app-specific sessions. Messaging, developer, cloud and crypto services may keep their own active-session lists.

If the extension stole a browser cookie, changing the password may not invalidate every session immediately. Use each service's explicit sign-out or session-revocation control.

Reset Chrome without assuming it deletes everything

Chrome's official reset instructions use Settings → Reset settings → Restore settings to their original defaults. Google says this resets areas including the default search engine, startup pages, pinned tabs, content settings, cookies/site data, extensions and themes while preserving bookmarks and saved passwords.

A reset is useful after removal, but it isn't an incident-response substitute. It doesn't revoke external sessions, rotate passwords, remove every operating-system program or prove that synced data was never exposed. After resetting, re-enable only extensions you recognise and still need.

When to create a new browser profile

If settings remain corrupted after the extension, policy and underlying software are gone, a fresh Chrome profile can provide a clean browser configuration. Export only necessary bookmarks through Chrome's supported interface. Don't blindly copy the old profile directory, because that can bring unwanted settings and extension state with it.

Scan beyond the browser

For evidence of credential theft, use the infostealer recovery order. For tools that reduce malicious pages and risky browser content, compare our browser security stack.

Prevent the next malicious extension

• Install from the official developer route and verify the publisher, not just the extension name.
• Keep the extension list short enough to recognise every item.
• Prefer “on click” or specific-site access when the tool doesn't need all-sites access.
• Pause when an update asks for broader permissions or the publisher changes.
• Remove tools you haven't used in a month rather than leaving dormant privilege.
• Keep Safe Browsing or the browser's equivalent reputation protection enabled.
• Use unique passwords and passkeys so one browser incident doesn't become every-account compromise.