# Browser Hijacker Removal: What to Do When Chrome or Edge Gets Taken Over URL: https://limehawk.io/reports/browser-hijacker-removal Published: 2026-10-02 Author: Corey Watson, Managing Member Topic: Guides Read time: 6 min Reset the browser, remove extensions, uninstall the app that brought it, and check chrome://policy. If it says managed and shouldn't, or it comes back, call IT. > **TL;DR** A browser hijacker changes your homepage, search engine, or new tab page, adds a toolbar or extension, and fills the screen with pop-ups. Most of them ride in with free software. The safe fix you can do yourself: reset Chrome or Edge to defaults, turn off every extension you don't recognize, uninstall the program that brought it from Windows Settings, and look at chrome://policy or edge://policy for rules you didn't set. Stop and call IT if the browser says "managed by your organization" on a PC nobody manages, or if the hijack comes back after you've cleaned it. That means something on the machine is putting it back. - OneStart reinstall task interval: 15 minutes ## What should I do right now if my browser was hijacked? Don't type passwords or card numbers into that browser until it's clean. Don't click "allow" on any pop-up asking for notification permission. Then work through four steps in order: reset the browser, remove extensions, uninstall the program that brought it, and check for policies. If you're on a work PC, tell IT before you start. A hijacker that injects ads can sit on every page, including your bank's login. If you've already logged into something sensitive while it was active, change that password from a different device once you're done here. If your office has IT, call them first. They may want to see the machine before you reset anything, and they can check the rest of the office for the same thing. When a hijacker shows up on one PC, it's often on others that installed the same free tool. ## What does a browser hijacker look like? A browser hijacker takes over the settings you normally control. The usual signs: - Your homepage, new tab page, or default search engine changed and you didn't change it. - Searches go through a site you've never heard of before landing on results. - A new toolbar, sidebar, or extension appeared. - Pop-ups and banner ads show up on sites that never had them. - Chrome or Edge says "Your browser is managed by your organization" on a PC nobody manages. Most hijackers come bundled with free software: PDF converters, video downloaders, "free" utilities. They install during the next-next-next part of the setup. Some are signed, "legitimate" programs that antivirus lets through. That's why [endpoint detection and response matters more than signature antivirus](/reports/edr-vs-antivirus) for this kind of thing. Fake download sites are a common source too, which we cover in [malvertising and fake software downloads](/reports/malvertising-fake-software-downloads). ## How do I remove a browser hijacker from Chrome? Reset Chrome, then remove extensions, then uninstall the program that brought it. Google's [steps for removing unwanted ads, pop-ups, and malware](https://support.google.com/chrome/answer/2765944) follow that order. 1. **Reset settings.** In Chrome, open the three-dot menu, then **Settings**, then **Reset settings**, then **Restore settings to their original defaults**, and confirm. Google says this [resets your default search engine, homepage and startup tabs, new tab page, pinned tabs, site permissions, cookies and site data, and extensions and themes](https://support.google.com/chrome/answer/3296214). Your bookmarks and saved passwords stay. 2. **Remove extensions.** Go to the three-dot menu, then **Extensions**, then **Manage extensions**. Remove anything you don't recognize. Google's advice is short: "Only turn on extensions you trust." 3. **Uninstall the program.** On Windows, open **Start**, then **Settings**, then **Apps**, then **Installed apps**. Sort by install date and look for anything that showed up around the time the browser changed. Uninstall it. 4. **Restart the PC** and open Chrome again. Check the homepage and search engine. ## How do I remove a browser hijacker from Edge? Edge works the same way. Open the three-dot menu, then **Settings**, then **Reset settings**, then **Restore settings to their default values**, and confirm. Then go to edge://extensions and remove anything you don't recognize. Uninstall the program from Windows **Installed apps** the same way you would for Chrome, and restart. If you use both browsers, clean both. A hijacker that came in through an installed program usually hits every browser on the machine. ## What does "managed by your organization" mean on my PC? It means browser policies are set on that machine. On a work PC, that's normal: your IT team sets them. On a personal PC, or a work PC your IT team says they don't manage that way, something else wrote them. Google's guidance is direct: ["If you believe your browser shouldn't be managed, contact your Google Account or device administrator."](https://support.google.com/chrome/answer/9281740) You can look without changing anything. Type chrome://policy in Chrome, or edge://policy in Edge. Microsoft [uses that same page](https://learn.microsoft.com/en-us/deployedge/configure-microsoft-edge) to show every policy applied to the browser. Look for policies that set a homepage, a search provider, or force-install an extension you didn't ask for. This is where the reset stops working. Microsoft's documentation says mandatory policies "override user preferences and prevent the user from changing the policy settings." A hijacker that writes policy wins against the reset button every time. Removing those policies means editing the registry, and that's IT's job. Don't go deleting registry keys from a forum post. ## When should I stop and call IT? Stop and call IT in any of these cases: - **It says "managed by your organization" and it shouldn't.** Rogue policy is past what a reset can fix. - **It came back.** If you reset, removed the extension, uninstalled the app, and it's back an hour or a day later, something on the machine is reinstalling it. - **It's a work PC.** Your IT team needs to know, and the same installer may be on other machines. - **You typed passwords into it** while it was active. Those accounts need resets from a clean device and a look at recent sign-ins. The "it came back" case is the one we've worked. In our [OneStart removal report](/reports/onestart-malware-removal), the Windows uninstaller removed the visible app and left scheduled tasks behind. The task ran every 15 minutes and put the whole thing back. Users had uninstalled it. Their IT contact had tried Control Panel. It kept returning until we killed the processes, deleted the scheduled tasks, and only then removed the files and registry entries. Order mattered more than the commands. That's why "it came back" means call IT. A reset won't find a scheduled task. ## How do we stop browser hijackers from coming back? Block extensions by default and allow only the ones you've approved. Both Chrome and Edge support this through policy, the same mechanism a hijacker abuses, used on purpose. In Edge, the [ExtensionInstallAllowlist policy](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/extensioninstallallowlist) works with the blocklist: "A blocklist value of * means all extensions are blocked and users can only install extensions listed in the allow list." Chrome has matching [ExtensionInstallAllowlist](https://chromeenterprise.google/policies/extension-install-allowlist/) and [ExtensionInstallBlocklist](https://chromeenterprise.google/policies/extension-install-blocklist/) policies. Set the blocklist to *, list the extensions your staff actually needs, and push it through Group Policy or Intune. The rest is ordinary hygiene: - **No local admin for daily work.** A user who can't install software can't install a bundled hijacker. - **EDR and DNS filtering**, so a known installer gets flagged or its domains get blocked. - **Custom install, every time.** Uncheck the bundled extras. Better yet, get software from IT instead of a download site. Hijackers are a nuisance more often than a breach. But the same install habits that let one in also let in worse things, like the [fake browser update pages behind SocGholish](/reports/socgholish-fake-browser-update). Fix the habit and you close both doors. If you want a written plan for the day it's worse than a hijacker, start with our [incident response plan template](/reports/incident-response-plan-template). ## Key takeaways - A browser reset fixes the settings, not the cause. Uninstall the program that brought the hijacker too, or it comes back. - Resetting Chrome keeps your bookmarks and passwords. It resets search, homepage, startup tabs, pinned tabs, site permissions, cookies, and turns off extensions. - "Managed by your organization" on a personal or unmanaged PC means something wrote browser policy. Check chrome://policy or edge://policy, then call IT. - If it comes back after cleanup, something is reinstalling it. That's a job for IT, not another reset. - The fix that sticks is an extension allow list set by policy, so only approved extensions can install. ## What this looks like when we do it On our [managed IT and security service](/services/managed-it-security), every machine gets the same baseline, with EDR and 24/7 monitoring on all of them. When a hijacker gets through, we don't reset browsers one at a time. We find what's reinstalling it, remove it in the right order across every affected machine with a script through our RMM, and block its domains at the DNS filter. That's what we did for OneStart across 30 machines. If you're seeing "managed by your organization" on PCs you don't manage, or a hijacker that keeps coming back, our [security service page](/services/managed-it-security) covers what the baseline includes. Clients get a response in under 15 minutes on critical issues. Want someone to look at it? Book a call and we'll walk through it.