How to Remove Malicious Browser Extensions Installed Without Permission

Unauthorized extensions can steal data or alter browsing, and Kudu can help you identify and remove suspicious add-ons.

What Causes This?

Malicious or unwanted browser extensions are often installed through bundled software, fake update prompts, shady download sites, or browser notifications that trick you into clicking “Allow” or “Add.” In some cases, adware already on the PC silently installs extensions or changes browser policies so the extension keeps coming back. Work or school management tools can also lock browser settings, so it’s important to confirm whether the extension is actually unauthorized before removing it.

Common Symptoms

• Your homepage, new tab page, or default search engine changes on its own
• You see extra ads, pop-ups, redirects, or sponsored search results
• The browser says an extension is “Installed by enterprise policy” or can’t be removed normally
• Browser performance suddenly gets worse, with high CPU or memory use
• Saved passwords, logins, or browsing sessions start acting strangely

How to Fix It Manually

1. Check your browser’s extensions page and remove anything suspicious

   • In Chrome, open Chrome and go to chrome://extensions
   • In Edge, go to edge://extensions
   • In Firefox, go to about:addons
   • Look for extensions you don’t recognize, recently installed add-ons, or anything with vague names
   • Turn the extension off first, then click Remove

2. Reset your browser’s search, homepage, and startup settings

   • In Chrome: go to Settings > Search engine and Settings > On startup
   • In Edge: go to Settings > Privacy, search, and services and Settings > Start, home, and new tabs
   • In Firefox: go to Settings > Home and Settings > Search
   • Change anything you didn’t choose yourself, such as a fake search provider or unknown startup page

3. Check for policy-based extensions that were forced onto the browser

   • In Chrome, type chrome://policy and press Enter
   • In Edge, type edge://policy and press Enter
   • If you see policies forcing an extension, note the extension ID or policy name
   • Press Win + R, type regedit, and press Enter
   • Check these Registry locations for browser policies:
     • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome
     • HKEY_CURRENT_USER\SOFTWARE\Policies\Google\Chrome
     • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
     • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Edge
   • Only remove policy entries if you’re sure they were not set by your workplace or school

4. Uninstall suspicious programs from Windows

   • Press Win + I to open Settings
   • Go to Apps > Installed apps
   • Sort by Install date
   • Remove anything unfamiliar that appeared around the same time as the extension, especially browser tools, “search assistants,” or “PDF converters”
   • Restart your PC after uninstalling

5. Look for startup apps and running processes tied to adware

   • Open Task Manager with Ctrl + Shift + Esc
   • Check the Startup apps tab and disable suspicious entries
   • In the Processes tab, look for unknown apps using a lot of CPU or memory
   • If needed, right-click a suspicious process and choose Open file location to identify it

6. Reset the browser if the problem keeps returning

   • In Chrome: Settings > Reset settings > Restore settings to their original defaults
   • In Edge: Settings > Reset settings > Restore settings to their default values
   • In Firefox: type about:support and use Refresh Firefox
   • This removes temporary browser changes and disables add-ons, but you may need to sign back into sites

Fix It Automatically with Kudu

Kudu can scan your system for suspicious browser extensions, policy changes, startup entries, and bundled apps that reinstall unwanted add-ons. Instead of hunting through browser settings, Registry keys, and installed programs manually, Kudu helps you find and remove the cause in one place.

Download Kudu Free →